| name | cis-ubuntu1804-v220-4-2-1 |
| description | Ensure permissions on /etc/ssh/sshd_config are configured |
| category | cis-networking |
| version | 2.2.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-18.04","ssh","remote-access"] |
| cis_id | 4.2.1 |
| cis_benchmark | CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 4.2.1
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Description
The /etc/ssh/sshd_config file contains configuration specifications for sshd. The command below sets the owner and group of the file to root.
Rationale
The /etc/ssh/sshd_config file needs to be protected from unauthorized changes by non-privileged users.
Audit Procedure
Command Line
Run the following command and verify Uid and Gid are both 0/root and Access does not grant permissions to group or other:
stat -c "%a %U %G" /etc/ssh/sshd_config
Expected Result
600 root root
OR more restrictive.
Remediation
Command Line
Run the following commands to set ownership and permissions on /etc/ssh/sshd_config:
chown root:root /etc/ssh/sshd_config
chmod og-rwx /etc/ssh/sshd_config
Default Value
Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root)
References
- NIST SP 800-53 Rev. 5: AC-3, MP-2
CIS Controls
v8 - 3.3 Configure Data Access Control Lists - Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.
v7 - 14.6 Protect Information through Access Control Lists - Protect all information stored on systems with file system, network share, claims, application, or database specific access control lists.
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Assessment Status
Automated
