The system must not permit root logins using remote access programs such as ssh.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| RHEL-06-000237 | RHEL-06-000237 | RHEL-06-000237_rule | Medium |
| Description |
|---|
| Permitting direct root login reduces auditable information about who ran privileged commands on the system and also allows direct attack attempts on root's password. |
| STIG | Date |
|---|---|
| Red Hat Enterprise Linux 6 Security Technical Implementation Guide | 2013-02-05 |
Details
| Check Text ( C-RHEL-06-000237_chk ) |
|---|
| To determine how the SSH daemon's "PermitRootLogin" option is set, run the following command: # grep -i PermitRootLogin /etc/ssh/sshd_config If a line indicating no is returned, then the required value is set. If the required value is not set, this is a finding. |
| Fix Text (F-RHEL-06-000237_fix) |
|---|
| The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line: PermitRootLogin no |