Detections
Analytics

4.2.4 Ensure sshd access is configured

Information

Several options are available to limit which users and groups can access the system via SSH. It is recommended that at least one of the following options be leveraged:

 - AllowUsers : The AllowUsers variable allows the system administrator to allow specific users to ssh into the system. The list consists of space-separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by only allowing the allowed users to log in from a particular host, the entry can be specified in the form of user@host.
 - AllowGroups : The AllowGroups variable allows the system administrator to allow specific groups of users to SSH into the system. The list consists of space-separated group names. This variable does not recognize numeric group IDs.
 - DenyUsers : The DenyUsers variable allows the system administrator to deny specific users the ability to ssh into the system. The list consists of space-separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by denying a user access from a particular host, the entry can be specified as user@host.
 - DenyGroups : The DenyGroups variable allows the system administrator to deny specific groups of users access to the system via SSH. The list consists of space-separated group names; this variable does not recognize numeric group IDs.

Restricting which users can remotely access the system via SSH will help ensure that only authorized users access the system.

Solution

Edit the /etc/ssh/sshd_config file to set one or more of the parameter above any Include entries as follows:

AllowUsers <userlist>
-OR-
AllowGroups <grouplist>
-OR-
DenyUsers <userlist>
-OR-
DenyGroups <grouplist>

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|4.3

Plugin: Unix

Control ID: 1febe9b9fcd69fede0c410ad42ee69b6ae17c85858f07bcc15bc1448d3c9da0c