Check: TOSS-04-040650
Tri-Lab Operating System Stack (TOSS) 4 STIG:
TOSS-04-040650
(in versions v2 r1 through v1 r1)
Title
The TOSS SSH daemon must perform strict mode checking of home directory configuration files. (Cat II impact)
Discussion
If other users have access to modify user-specific SSH configuration files, they may be able to log on to the system as another user.
Check Content
Verify the SSH daemon performs strict mode checking of home directory configuration files with the following command: $ sudo grep -i strictmodes /etc/ssh/sshd_config StrictModes yes If "StrictModes" is set to "no", is missing, or the returned line is commented out, this is a finding.
Fix Text
Configure SSH to perform strict mode checking of home directory configuration files. Uncomment the "StrictModes" keyword in "/etc/ssh/sshd_config" and set the value to "yes": StrictModes yes The SSH daemon must be restarted for the changes to take effect. To restart the SSH daemon, run the following command: $ sudo systemctl restart sshd.service
Additional Identifiers
Rule ID: SV-253106r991589_rule
Vulnerability ID: V-253106
Group Title: SRG-OS-000480-GPOS-00227
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
Implement the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |