TMA-COS-5.1.10

Ensure SSH root login is disabled

MediumLevel 1Automatedcos

Description

The PermitRootLogin parameter specifies if the root user can log in using ssh. The default is no. Disallowing root logins over SSH requires system admins to authenticate using their own individual account, then escalating to root via sudo or su. This in turn limits opportunity for non-repudiation and provides a clear audit trail in the event of a security incident

How it is checked

Audit method: Shell command

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v sshd >/dev/null 2>&1 || { echo "step1: sshd not installed"; return 1; }; o=$(bash -c 'sshd -T | grep permitrootlogin' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'PermitRootLogin no' || { echo step1: missing 'PermitRootLogin no'; return 1; }; }; if alt0; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Edit the /etc/ssh/sshd_config file to set the parameter as follows: PermitRootLogin no

Properties

Operating systems: Any
Tags: container-optimized-oscosloggingssh
Reference: CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.1.10 Ensure SSH root login is disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target cos