Detections
Analytics

5.1.32 Ensure sshd StrictModes is enabled

Information

The operating system's SSH daemon must perform strict mode checking of home directory configuration files.

If other users have access to modify user-specific SSH configuration files, they may be able to log on to the system as another user.

Solution

Configure SSH to perform strict mode checking of home directory configuration files.

Edit the /etc/ssh/sshd_config file to set the StrictModes parameter to yes above any Include entry as follows:

StrictModes yes

Note: First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.

The SSH daemon must be restarted for the changes to take effect. To restart the SSH daemon, run the following command:

# systemctl reload-or-restart sshd.service

See Also

https://workbench.cisecurity.org/benchmarks/19886

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, Rule-ID|SV-230288r951600_rule, Vuln-ID|V-230288

Plugin: Unix

Control ID: 63d4c84bc950f10111fcb052a49ddb0b71f15ca175c10ca775a8a9987b8c7b76