OpenSSH

You can file an issue about it and ask that it be added.

---

Table of Contents

• OpenSSH
  • Disable empty passwords
  • Idle timeout
  • Idle timeout interval
  • Warning banner
  • Hash algorithms
  • Environment options
  • Protocol version
  • Support for .rhosts
  • Log levels
  • Remote X11 connections
  • Validated ciphers
  • Authentication
  • Root login

OpenSSH

The SSH protocol is recommended for remote login and remote file transfer. SSH provides confidentiality and integrity for data exchanged between two systems, as well as server authentication, through the use of public key cryptography.

Disable empty passwords

Rationale

Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.

Solution

Explicitly disallow SSH login from accounts with empty passwords

PermitEmptyPasswords no

^{C2S/CIS: CCE-27471-2 (High)}

Idle timeout

Rationale

This ensures a user login will be terminated as soon as the ClientAliveInterval is reached.

Solution

Sets the number of client alive messages

ClientAliveCountMax 0

^{C2S/CIS: CCE-27082-7 (Medium)}

Idle timeout interval

Rationale

Terminating an idle ssh session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been let unattended.

Solution

Set short time period

ClientAliveInterval 300

^{C2S/CIS: CCE-27433-2 (Medium)}

Warning banner

Rationale

The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers.

Solution

Set short time period

Banner /etc/issue

^{C2S/CIS: CCE-27314-4 (Medium)}

Hash algorithms

Rationale

DoD Information Systems are required to use FIPS-approved cryptographic hash functions. The only SSHv2 hash algorithms meeting this requirement is SHA2.

Solution

Use of FIPS-approved MACs

MACs hmac-sha2-512,hmac-sha2-256,hmac-sha1

^{C2S/CIS: CCE-27455-5 (Medium)}

Environment options

Rationale

SSH environment options potentially allow users to bypass access restriction in some configurations.

Solution

Override environment options

PermitUserEnvironment no

^{C2S/CIS: CCE-27363-1 (Medium)}

Protocol version

Rationale

SSH protocol version 1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system.

Solution

Set correct protocol version

Protocol 2

^{C2S/CIS: CCE-27320-1 (High)}

Support for .rhosts

Rationale

SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.

Solution

Set correct protocol version

IgnoreRhosts yes

^{C2S/CIS: CCE-27377-1 (Medium)}

Log levels

Rationale

SSH provides several logging levels with varying amounts of verbosity. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The INFO parameter specifices that record login and logout activity will be logged.

Solution

Set specify the log level

LogLevel INFO

^{C2S/CIS: CCE-80645-5 (Medium)}

Validated ciphers

Rationale

Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and system data may be compromised.

Solution

Set algorithms which are FIPS-approved

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

^{C2S/CIS: CCE-27295-5 (High)}

Remote X11 connections

Rationale

By default, remote X11 connections are not encrypted when initiated by users. Open X displays allow an attacker to capture keystrokes and to execute commands remotely.

Solution

Enable encrypted X11 forwarding

X11Forwarding yes

^{C2S/CIS: CCE-80226-4 (High)}

Authentication

Rationale

SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.

Setting the MaxAuthTries parameter to a low number will minimize the risk of successful brute force attacks to the SSH server.

Solution

Disable host-based authentication

HostbasedAuthentication no

^{C2S/CIS: CCE-27413-4 (Medium)}

Set authentication attempt limit

MaxAuthTries tries

^{C2S/CIS: No-CCE (Medium)}

Root login

Rationale

The root user should never be allowed to login to a system directly over a network.

Solution

Disable root login via SSH

PermitRootLogin no

^{C2S/CIS: CCE-27445-6 (Medium)}

Comments

The C2S/CIS standard also explain X11Forwarding parameter. In my opinion we should definitely disable X session.

Useful resources

• Configuring OpenSSH ^[Official]