Ensure sshd access is configured

MédiaNível 1Automatizadaaix

Descrição

There are several options available to limit which users and group can access the system via SSH. It is recommended that at least one of the following options be leveraged: AllowUsers: o The AllowUsers variable gives the system administrator the option of allowing specific users to ssh into the system. The list consists of space separated user names. Audit: sshd -T must show at least one AllowUsers/AllowGroups/DenyUsers/DenyGroups; review the lists against site policy.

Como é verificado

Método de auditoria: Comando shell

shell

command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; r=compliant; for p in '^(allowusers|allowgroups|denyusers|denygroups)[[:blank:]]+[^[:blank:]]'; do printf '%s\n' "$out" | grep -Eiq -- "$p" || r="not matched: $p"; done; echo "$r"

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Edit the /etc/ssh/sshd_config file to set one or more of the parameter above any Match set entries as follows: AllowUsers <userlist> -OR- AllowGroups <grouplist> -OR- DenyUsers <userlist> -OR- DenyGroups <grouplist> Re-cycle the sshd daemon to pick up the configuration changes: stopsrc -s sshd startsrc -s sshd Note: First occurrence of a option takes precedence, Match set statements withstanding.

Propriedades

Sistemas operacionais: Qualquer
Tags: aixssh
Referência: CIS IBM AIX 7 Benchmark v1.2.0 - 4.6.3.4 Ensure sshd access is configured

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target aix