Detections
Analytics

4.6.3.14 Ensure sshd PermitRootLogin is configured

Information

This recommendation disables direct root login via SSH using a password. To be absolutely certain direct login is disabled the recommendation requires this variable is set rather than rely on a default that might change after an update to SSH.

The recommendation requires an edit of the file /etc/ssh/sshd_config file to disable direct root login.

All root access should be facilitated through a local logon with a unique and identifiable user ID and then via the su command once locally authenticated.

Direct root login using passwords is insecure and does not provide sufficient logging or audit trailing for accountability.

Direct root login via SSH was enabled by default with prior versions of OpenSSH.

Solution

#!/usr/bin/ksh
PREFERRED_SETTING="prohibit-password"
umask 077
set $(/usr/bin/egrep "^PermitRootLogin" /etc/ssh/sshd_config)
echo $?
if [[ ! -z $1 ]]; then
 # Look for a setting and change to no if anything else
 if [[ $2 != ${PREFERRED_SETTING} ]]; then
 sed "s/^PermitRootLogin \{1\}[^ ]\{1,\}/PermitRootLogin ${PREFERRED_SETTING}/" /etc/ssh/sshd_config >/tmp/sshd_config.$$
 fi
else
 # Look for a comment and append
 sed "/^# \{0,\}PermitRootLogin/ a\^JPermitRootLogin ${PREFERRED_SETTING}/" /etc/ssh/sshd_config >/tmp/sshd_config.$$
fi

if [[ -e /tmp/sshd_config.$$ ]]; then
 diff -u /tmp/sshd_config.$$ /etc/ssh/sshd_config
 rm /tmp/sshd_config.$$
elif
 # Verify setting is specified
 /usr/bin/egrep "^PermitRootLogin" /etc/ssh/sshd_config >>/dev/null
 if [[ $? -ne 0 ]]; then
 print "PermitRootLogin ${PREFERRED_SETTING}" >> /etc/ssh/sshd_config
 fi
fi

Re-cycle the sshd daemon to pick up the configuration changes:

stopsrc -s sshd
sleep 5
startsrc -s sshd

Impact:

The level 1 recommendation does not require a setting of no - setting the attribute to no requires either sharing a root password (to use su ), the installation of sudo, or a configuration using extended RBAC for actions that require enhanced privileges.

The recommendation 4.3.6.10 specifies a LOG_LEVEL of INFO or DEBUG.

To resolve, partially, the accountability concerns, permitting publickey authentication as root together with LogLevel INFO (minimum) provides the following syslog information:

Jun 25 09:26:41 x071 auth|security:info sshd[8323282]: Accepted publickey for michael from 192.168.129.11 port 54278 ssh2: RSA SHA256:dRHxa5CGr5HCdC89suwYIBtAT8lyogz4SErSxTq0JXk
Jun 25 09:26:52 x071 auth|security:info sshd[8847396]: Accepted publickey for root from 192.168.129.11 port 54279 ssh2: RSA SHA256:dRHxa5CGr5HCdC89suwYIBtAT8lyogz4SErSxTq0JXk
Jun 25 09:26:53 x071 auth|security:info sshd[9044142]: Accepted publickey for root from 192.168.129.11 port 54280 ssh2: RSA SHA256:dRHxa5CGr5HCdC89suwYIBtAT8lyogz4SErSxTq0JXk

Local site policy might decide that publickey accountability is sufficient and a setting of PermitRootLogin prohibit-password (the new default) provides sufficient accountability and security.

Note: only public keys in a file such as ~root/.ssh/authorized_keys will be able to connect.

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|9.2

Plugin: Unix

Control ID: 735d0a1e7c60a3ec11bec5006d454fc80ec02a5fb5aa11b485c0cd8c456a4058