Navigate

Check: GEN001120

SUSE Linux Enterprise Server v11 for System z STIG: GEN001120 (in versions v1 r12 through v1 r9)

Title

The system must not permit root logins using remote access programs such as ssh. (Cat II impact)

Discussion

Even though communications are encrypted, an additional layer of security may be gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account preserves the audit trail.

Check Content

Determine if the SSH daemon is configured to permit root logins. Procedure: # grep -v "^#" /etc/ssh/sshd_config | grep -i permitrootlogin If the PermitRootLogin entry is not found or is not set to "no", this is a finding.

Fix Text

Edit the sshd_config file and set the PermitRootLogin option to "no".

Additional Identifiers

Rule ID: SV-44922r1_rule

Vulnerability ID: V-1047

Group Title: GEN001120

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-000770	The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
IA-2 (5)	Group Authentication