Detections
Analytics

5.1.1 Ensure access to sshd_config files is configured

Information

sshd(8) reads configuration data from /etc/ssh/sshd_config ( /usr/etc/ssh/sshd_config if the file does not exist or the file specified with -f on the command line).

More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

Configuration specifications for sshd need to be protected from unauthorized changes by non-privileged users.

Solution

Run the following commands to set ownership and permissions to the appropriate sshd_config file:

# chmod u-x,og-rwx </path/to/sshd_config>
# chown root:root </path/to/sshd_config>

Note: If other locations are listed in an Include statement, *.conf files in these locations access should also be modified.

See Also

https://workbench.cisecurity.org/benchmarks/26236

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 1a0af71582b167ff522189a7c88a5f5c85f7f52f5a78601b2161050a40702343