Title

Unattended or automatic login via ssh must not be allowed. (Cat I impact)

Discussion

Failure to restrict system access to authenticated users negatively impacts Ubuntu operating system security.

Check Content

Verify that unattended or automatic login via ssh is disabled. Check that unattended or automatic login via ssh is disabled with the following command: # egrep '(Permit(.*?)(Passwords|Environment))' /etc/ssh/sshd_config PermitEmptyPasswords no PermitUserEnvironment no If "PermitEmptyPasswords" or "PermitUserEnvironment" keywords are not set to "no", is missing completely, or they are commented out, this is a finding.

Fix Text

Configure the SSH daemon to not allow unattended or automatic login to the system. Add or edit the following lines in the "/etc/ssh/sshd_config" file: PermitEmptyPasswords no PermitUserEnvironment no

Additional Identifiers

Rule ID: SV-90513r2_rule

Vulnerability ID: V-75833

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.