Skip to content
ATO Pathways
  Log In

Disable SSH Server If Possible

An XCCDF Rule

Description

The SSH server service, sshd, is commonly needed. However, if it can be disabled, do so. This is unusual, as SSH is a common method for encrypted and authenticated remote access.

ID
xccdf_org.ssgproject.content_rule_service_sshd_disabled
Severity
High
References
Updated



Remediation - Puppet

include disable_sshd

class disable_sshd {
  service {'ssh':
    enable => false,
    ensure => 'stopped',

Remediation - Ansible

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-3(6)
  - NIST-800-53-IA-2(4)

Remediation - OS Build Blueprint


[customizations.services]
masked = ["ssh"]

Remediation - Shell Script

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}
' 'kernel' 2>/dev/null | grep -q installed; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'ssh.service'

Remediation - Kubernetes Patch

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0