Configuring SSH - set privilege separation

ВысокийУровень 1Ручная проверкаibm-i

Описание

The recommendation is to edit the /QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config file to ensure that privilege separation is enabled. Note, that as of OpenSSH 7.5 this configuration directive has been deprecated. Setting privilege separation helps to secure remote ssh access. Once a user is authenticated the sshd daemon creates a child process which has the privileges of the authenticated user and this then handles incoming network traffic.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

DSPF '/QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config' On the Control field, type UsePrivilegeSeparation and press F16 (shift F4) Control: UsePrivilegeSeparation __________________________________ The display should yield the following output: UsePrivilegeSeparation yes

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

EDTF '/QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config' file to ensure that privilege separation is enabled: Replace: UsePrivilegeSeparation no With: UsePrivilegeSeparation yes Re-cycle the sshd daemon to pick up the configuration changes: Note: In IBM i OpenSSH 6.9p1, UsePrivilegeSeparation is explicitly set to "no". Once upgrading to 8.0p1, UsePrivilegeSeparation is deprecated. There is a warning message generated when the sshd server is started when the option exists in sshd_config. To disable the warning, you can comment out or remove the line containing UsePrivilegeSeparation from the sshd_config file.

Свойства

Операционные системы: Любая
Теги: ibm-issh
Источник: CIS IBM i V7R5M0 Benchmark v2.1.0 - 5.4.4 Configuring SSH - set privilege separation