Detections
Analytics

GEN005540 - The SSH daemon must be configured for IP filtering - '/etc/hosts.deny'

Information

The SSH daemon must be configured for IP filtering to provide a layered defense against connection attempts from unauthorized addresses.

Solution

Add appropriate IP restrictions for SSH to the /etc/hosts.deny and/or /etc/hosts.allow files.
TCP Wrappers can be installed using SMIT from the AIX expansion pack as fileset netsec.options.tcpwrappers.

See Also

https://iasecontent.disa.mil/stigs/zip/U_AIX_6-1_V1R14_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Group-ID|V-12022, Rule-ID|SV-38955r1_rule, STIG-ID|GEN005540, Vuln-ID|V-12022

Plugin: Unix

Control ID: 6315d003018589699290ef0cf54ee2d3f8b4d01ee450225cb0e5b5234958215e