cis-ubuntu2004-v300-5-1-1

name	cis-ubuntu2004-v300-5-1-1
description	Ensure access to /etc/ssh/sshd_config is configured
category	cis-networking
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","ssh"]
cis_id	5.1.1
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure access to /etc/ssh/sshd_config is configured (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

The file /etc/ssh/sshd_config, and files ending in .conf in the /etc/ssh/sshd_config.d directory, contain configuration specifications for sshd.

Rationale

Configuration specifications for sshd need to be protected from unauthorized changes by non-privileged users.

Audit Procedure

Command Line

Run the following script and verify /etc/ssh/sshd_config and files ending in .conf in the /etc/ssh/sshd_config.d directory are:

• Mode 0600 or more restrictive
• Owned by the root user
• Group owned by the group root.

#!/usr/bin/env bash

{
  a_output=(); a_output2=()
  perm_mask='0177' && maxperm="$( printf '%o' $(( 0777 & ~$perm_mask )) )"
  f_sshd_files_chk()
  {
    while IFS=: read -r l_mode l_user l_group; do
      a_out2=()
      [ $(( $l_mode & $perm_mask )) -gt 0 ] && a_out2+=("      Is mode: \"$l_mode\" \
       should be mode: \"$maxperm\" or more restrictive")
      [ "$l_user" != "root" ] && a_out2+=("      Is owned by \"$l_user\" should be owned by \"root\"")
      [ "$l_group" != "root" ] && a_out2+=("      Is group owned by \"$l_user\" should be group owned by \"root\"")
      if [ "" -gt  ]; 
        a_output2+=( )
      
        a_output+=( )
      
     < <( -Lc  )
  }
  {
    [ -e  ] && l_file= && f_sshd_files_chk
     IFS=  -r -d $ l_file; 
      [ -e  ] && f_sshd_files_chk
     < <(find /etc/ssh/sshd_config.d - f -name  \( -perm /077 -o ! -user root -o ! -group root \) -print0 2>/dev/null)
  }
   [  -le 0 ]; 
          
  
          
    [  -gt 0 ] &&      
  
}