Ensure SSH root login is disabled

中等級 1自動化cos

說明

The PermitRootLogin parameter specifies if the root user can log in using ssh. The default is no. Disallowing root logins over SSH requires system admins to authenticate using their own individual account, then escalating to root via sudo or su. This in turn limits opportunity for non-repudiation and provides a clear audit trail in the event of a security incident

檢查方式

稽核方法: Shell 指令

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v sshd >/dev/null 2>&1 || { echo "step1: sshd not installed"; return 1; }; o=$(bash -c 'sshd -T | grep permitrootlogin' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'PermitRootLogin no' || { echo step1: missing 'PermitRootLogin no'; return 1; }; }; if alt0; then echo compliant; fi

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Edit the /etc/ssh/sshd_config file to set the parameter as follows: PermitRootLogin no

屬性

作業系統: 不限
標籤: container-optimized-oscosloggingssh
參考資料: CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.1.10 Ensure SSH root login is disabled

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target cos