Detections
Analytics

2.1.11 Ensure openssh server services are not in use

Information

Secure Shell (SSH) is a secure, encrypted replacement for common login services such as telnet, ftp, rlogin, rsh, and rcp . It is strongly recommended that sites abandon older clear-text login protocols and use SSH to prevent session hijacking and sniffing of sensitive data off the network.

Unless there is a need to provide remote access to the system, it is recommended that the package be removed to reduce the potential attack surface.

Solution

Run the following commands to stop ssh.socket and ssh.service, and remove the openssh-server package:

# systemctl stop ssh.socket ssh.service
# apt purge openssh-server

- OR -

- IF - the openssh-server package is required as a dependency:

Run the following commands to stop and mask ssh.socket and ssh.service :

# systemctl stop ssh.socket ssh.service
# systemctl mask ssh.socket ssh.service

Impact:

openSSH server is used to provide secure, encrypted remote access to the system.

See Also

https://workbench.cisecurity.org/benchmarks/20741

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 84b27a378023170bb05fb9ed1ba474fd004311e391e42f7dec9f34cc5e7a57a7