Skip to content
Log In

Disable SSH Server If Possible

An XCCDF Rule

Description

The SSH server service, sshd, is commonly needed. However, if it can be disabled, do so. This is unusual, as SSH is a common method for encrypted and authenticated remote access.
ID
xccdf_org.ssgproject.content_rule_service_sshd_disabled
Severity
High
References
Updated

Remediation Templates

script:kickstart

service disable sshd

A Puppet Snippet

include disable_sshd
class disable_sshd {
  service {'sshd':
    enable => false,
    ensure => 'stopped',
  }
}

OS Build Blueprint

[customizations.services]
masked = ["sshd"]

An Ansible Snippet

- name: Disable SSH Server If Possible - Collect systemd Services Present in the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false

A Shell Script

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'sshd.service'
"$SYSTEMCTL_EXEC" disable 'sshd.service'
"$SYSTEMCTL_EXEC" mask 'sshd.service'

A Kubernetes Patch

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0