Detections
Analytics

1.235 RHEL-09-255165

Information

RHEL 9 SSH daemon must display the date and time of the last successful account logon upon an SSH logon.

GROUP ID: V-258009
RULE ID: SV-258009r1045077

Providing users feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.

Solution

Configure the SSH daemon to provide users with feedback on when account accesses last occurred.

Add the following line to "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d", or uncomment the line and set the value to "yes":

PrintLastLog yes

The SSH service must be restarted for changes to take effect:

$ sudo systemctl restart sshd.service

See Also

https://workbench.cisecurity.org/benchmarks/22008

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258009r1045077_rule, STIG-ID|RHEL-09-255165, Vuln-ID|V-258009

Plugin: Unix

Control ID: c7b762045e23d0b1d5cdb717eea225c248bb04e53d93d1922171c9f3abad54af