Configuring SSH - set privilege separation

높음레벨 1수동 검토ibm-i

설명

The recommendation is to edit the /QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config file to ensure that privilege separation is enabled. Note, that as of OpenSSH 7.5 this configuration directive has been deprecated. Setting privilege separation helps to secure remote ssh access. Once a user is authenticated the sshd daemon creates a child process which has the privileges of the authenticated user and this then handles incoming network traffic.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

DSPF '/QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config' On the Control field, type UsePrivilegeSeparation and press F16 (shift F4) Control: UsePrivilegeSeparation __________________________________ The display should yield the following output: UsePrivilegeSeparation yes

조치 방법

조치 방식: 가이드 또는 인프라 패치

EDTF '/QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config' file to ensure that privilege separation is enabled: Replace: UsePrivilegeSeparation no With: UsePrivilegeSeparation yes Re-cycle the sshd daemon to pick up the configuration changes: Note: In IBM i OpenSSH 6.9p1, UsePrivilegeSeparation is explicitly set to "no". Once upgrading to 8.0p1, UsePrivilegeSeparation is deprecated. There is a warning message generated when the sshd server is started when the option exists in sshd_config. To disable the warning, you can comment out or remove the line containing UsePrivilegeSeparation from the sshd_config file.

속성

운영 체제: 모두
태그: ibm-issh
참고 자료: CIS IBM i V7R5M0 Benchmark v2.1.0 - 5.4.4 Configuring SSH - set privilege separation