Configuring SSH - set privilege separation

VisokaNivo 1Ručni pregledibm-i

Opis

The recommendation is to edit the /QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config file to ensure that privilege separation is enabled. Note, that as of OpenSSH 7.5 this configuration directive has been deprecated. Setting privilege separation helps to secure remote ssh access. Once a user is authenticated the sshd daemon creates a child process which has the privileges of the authenticated user and this then handles incoming network traffic.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

DSPF '/QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config' On the Control field, type UsePrivilegeSeparation and press F16 (shift F4) Control: UsePrivilegeSeparation __________________________________ The display should yield the following output: UsePrivilegeSeparation yes

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

EDTF '/QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config' file to ensure that privilege separation is enabled: Replace: UsePrivilegeSeparation no With: UsePrivilegeSeparation yes Re-cycle the sshd daemon to pick up the configuration changes: Note: In IBM i OpenSSH 6.9p1, UsePrivilegeSeparation is explicitly set to "no". Once upgrading to 8.0p1, UsePrivilegeSeparation is deprecated. There is a warning message generated when the sshd server is started when the option exists in sshd_config. To disable the warning, you can comment out or remove the line containing UsePrivilegeSeparation from the sshd_config file.

Svojstva

Operativni sistemi: Bilo koji
Oznake: ibm-issh
Referenca: CIS IBM i V7R5M0 Benchmark v2.1.0 - 5.4.4 Configuring SSH - set privilege separation