TMA-ROS1-5.2.10

Ensure SSH root login is disabled

HighLevel 1Automatedros

Description

The PermitRootLogin parameter specifies if the root user can log in using ssh. The default is no. The audit requires PermitRootLogin no. The audit reads the effective sshd configuration (sshd -T, root). Host-level control from the CIS ROS Melodic benchmark (Ubuntu 18.04 robot hosts); run as root.

How it is checked

Audit method: Shell command

shell

command -v sshd >/dev/null 2>&1 || exit 1
out=$(sshd -T -C user=root -C host="$(hostname)" -C addr="$(hostname -I 2>/dev/null | cut -d' ' -f1)" 2>/dev/null) || out=$(sshd -T 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk 'tolower($1)=="permitrootlogin"{print tolower($2); exit}')
case "$v" in no) echo compliant ;; *) echo "PermitRootLogin ${v:-unset}" ;; esac

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Edit the /etc/ssh/sshd_config file to set the parameter as follows: PermitRootLogin no

Properties

Operating systems: Any
Tags: rosros1melodicaccess-control
Reference: CIS ROS Melodic Benchmark v1.0.0 - 5.2.10 Ensure SSH root login is disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target ros