Detections
Analytics

5.13 Ensure 'OpenSSH SSH Server (sshd)' is set to 'Disabled' or 'Not Installed'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

SSH protocol based service to provide secure encrypted communications between two untrusted hosts over an insecure network.

The recommended state for this setting is: Disabled or Not Installed.

Note: This service is not installed by default. It is supplied with Windows, but it is installed by enabling an optional Windows feature (OpenSSH Server).

Rationale:

Hosting an SSH server from a workstation is an increased security risk, as the attack surface of that workstation is then greatly increased.

Note: This security concern applies to any SSH server application installed on a workstation, not just the one supplied with Windows.

Impact:

The workstation will not be permitted to be a SSH host server.

Solution

To establish the recommended configuration via GP, set the following UI path to: Disabled or ensure the service is not installed.

Computer Configuration\Policies\Windows Settings\Security Settings\System Services\OpenSSH SSH Server




Default Value:

Not Installed (Manual when installed)

See Also

https://workbench.cisecurity.org/files/2992

Item Details

References: CSCv7|9.2

Plugin: Windows

Control ID: 8d71a8edd4a8d2b7ad74ae14947b7f42b80409db216485cd0f19a12fc2a1b2d4