Ensure sshd is not run within containers

MediumLevel 1Automateddocker

Description

Running an SSH server inside a container adds attack surface and complicates credential and patch management; use docker exec instead. The audit lists processes of every running container with docker top (no exec into the container) and flags those running sshd.

How it is checked

Audit method: Shell command

shell

ids=$(docker ps -q) || exit 1; bad=''; for i in $ids; do p=$(docker top "$i" -eo comm 2>/dev/null || docker top "$i") || exit 1; printf '%s\n' "$p" | grep -Eq '(^|[ /])sshd( |$)' && bad="$bad $i"; done; [ -z "$bad" ] && echo compliant || echo "sshd running in:$bad"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Remove the SSH server from the image and use docker exec (or an orchestrator equivalent) for administrative access.

Properties

Operating systems: Any
Tags: dockerruntime
Reference: CIS Docker Benchmark v1.9.0 - 5.7 Ensure sshd is not run within containers

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target docker