Title

The SSH daemon must restrict login ability to specific users and/or groups. (Cat II impact)

Discussion

Restricting SSH logins to a limited group of users, such as system administrators, prevents password-guessing and other SSH attacks from reaching system accounts and other accounts not authorized for SSH access.

Check Content

Check the SSH daemon configuration for the AllowGroups setting. # grep -i AllowGroups /etc/ssh/sshd_config | grep -v '^#' If no lines are returned, this is a finding.

Fix Text

Edit the SSH daemon configuration and add an AllowGroups directive.

Additional Identifiers

Rule ID: SV-226992r603265_rule

Vulnerability ID: V-226992

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.