Detections
Analytics

5.1.2 Ensure access to /etc/ssh/sshd_config.d/ directory is configured

Information

/etc/ssh/sshd_config.d/ is the default drop-in configuration directory for the OpenSSH server daemon ( sshd ). The line Include /etc/ssh/sshd_config.d/*.conf shipped in the default /etc/ssh/sshd_config causes every file in this directory ending in .conf to be processed as part of the effective server configuration, with first-occurrence-wins precedence over directives that follow the Include in the parent file.

This recommendation governs the directory itself : ownership of /etc/ssh/sshd_config.d/, and the mode bits applied to the directory inode. It complements recommendation 5.1.1 ( Ensure access to /etc/ssh/sshd_config is configured ), which governs the parent file and the *.conf drop-in files inside this directory but does not constrain the directory entry.

More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

A drop-in configuration directory at the default mode of 0755 root:root is world-readable and world-traversable. Any local user can therefore:

 - Enumerate the per-host SSH server policy
 - Read the contents of any .conf drop-in that itself is world-readable
 - Reconnoitre for related artifacts: AllowGroups lists, ListenAddress restrictions, banner paths, alternative HostKey paths, and AuthorizedKeysFile overrides each reveal information useful to an attacker performing local reconnaissance prior to privilege escalation or lateral movement.

Configuration specifications for sshd - including the per-host overrides contained in this directory - need to be protected from unauthorized disclosure as well as unauthorized modification by non-privileged users. Restricting the directory to mode 0700 root:root ensures that only the root user can list, traverse, or modify the directory, matching the protection already required for the parent sshd_config file and the .conf files inside the directory.

Solution

Run the following commands to set ownership and mode on /etc/ssh/sshd_config.d/ :

# chown root:root /etc/ssh/sshd_config.d/
# chmod 0700 /etc/ssh/sshd_config.d/

Note: If the SSH server reads drop-in files from an additional Include location, apply the same ownership and mode to each such directory.

No service reload is required - the directory mode does not affect the running sshd process, only future reads of the directory.

See Also

https://workbench.cisecurity.org/benchmarks/27798

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 258ebabeabf2282a1d279b297220d1d9e403f3541958cfd8dd7b956b2ba8cd99