Detections
Analytics

5.1.21 Ensure sshd PermitRootLogin is disabled

Information

The PermitRootLogin parameter specifies if the root user can log in using SSH. The default is prohibit-password.

Disallowing root logins over SSH requires system admins to authenticate using their own individual account, then escalating to root . This limits opportunity for non-repudiation and provides a clear audit trail in the event of a security incident.

Solution

Edit the /etc/ssh/sshd_config file to set the PermitRootLogin parameter to no above any Include and Match entries as follows:

PermitRootLogin no

Impact:

With PermitRootLogin set to no, the root account cannot authenticate directly over SSH. Administrators must connect with an individual account and then escalate privileges. Any automation or process that logs in directly as root over SSH will need to be reworked to use a named account before this recommendation is applied.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2, CSCv7|4.3

Plugin: Unix

Control ID: 8adfe0b663e5fefbc76b1ccbcb0b0bb361dfe0883d6d5564129df9eef18bf127