IBM AIX
TMA-AIX-4.6.3.4
Ensure sshd access is configured
Description
There are several options available to limit which users and group can access the system via SSH. It is recommended that at least one of the following options be leveraged: AllowUsers: o The AllowUsers variable gives the system administrator the option of allowing specific users to ssh into the system. The list consists of space separated user names. Audit: sshd -T must show at least one AllowUsers/AllowGroups/DenyUsers/DenyGroups; review the lists against site policy.
How it is checked
Audit method: Shell command
command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; r=compliant; for p in '^(allowusers|allowgroups|denyusers|denygroups)[[:blank:]]+[^[:blank:]]'; do printf '%s\n' "$out" | grep -Eiq -- "$p" || r="not matched: $p"; done; echo "$r"- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Edit the /etc/ssh/sshd_config file to set one or more of the parameter above any Match set entries as follows: AllowUsers <userlist> -OR- AllowGroups <grouplist> -OR- DenyUsers <userlist> -OR- DenyGroups <grouplist> Re-cycle the sshd daemon to pick up the configuration changes: stopsrc -s sshd startsrc -s sshd Note: First occurrence of a option takes precedence, Match set statements withstanding.
Properties
- Operating systems
- Any
- Tags
- aixssh
- Reference
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.6.3.4 Ensure sshd access is configured
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target aix