TMA-AIX-4.6.3.4
Ensure sshd access is configured
Descripción
There are several options available to limit which users and group can access the system via SSH. It is recommended that at least one of the following options be leveraged: AllowUsers: o The AllowUsers variable gives the system administrator the option of allowing specific users to ssh into the system. The list consists of space separated user names. Audit: sshd -T must show at least one AllowUsers/AllowGroups/DenyUsers/DenyGroups; review the lists against site policy.
Cómo se verifica
Método de auditoría: Comando de shell
command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; r=compliant; for p in '^(allowusers|allowgroups|denyusers|denygroups)[[:blank:]]+[^[:blank:]]'; do printf '%s\n' "$out" | grep -Eiq -- "$p" || r="not matched: $p"; done; echo "$r"- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Edit the /etc/ssh/sshd_config file to set one or more of the parameter above any Match set entries as follows: AllowUsers <userlist> -OR- AllowGroups <grouplist> -OR- DenyUsers <userlist> -OR- DenyGroups <grouplist> Re-cycle the sshd daemon to pick up the configuration changes: stopsrc -s sshd startsrc -s sshd Note: First occurrence of a option takes precedence, Match set statements withstanding.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- aixssh
- Referencia
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.6.3.4 Ensure sshd access is configured
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target aix