OL 8 must not permit direct logons to the root account using remote access via SSH.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-248613 | OL08-00-010550 | SV-248613r1015039_rule | CCI-004045 | medium |
| Description | ||||
| Although the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging on directly as root. In addition, logging on with a user-specific account provides individual accountability of actions performed on the system. | ||||
| STIG | Date | |||
| Oracle Linux 8 Security Technical Implementation Guide | 2025-05-13 | |||
Details
Check Text (C-248613r1015039_chk)
Verify remote access using SSH prevents users from logging on directly as "root" with the following command:
$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permitrootlogin'
PermitRootLogin no
If the "PermitRootLogin" keyword is set to "yes", is missing, or is commented out, this is a finding.
If conflicting results are returned, this is a finding.
Fix Text (F-52001r779404_fix)
Configure OL 8 to stop users from logging on remotely as the "root" user via SSH.
Edit the appropriate "/etc/ssh/sshd_config" file to uncomment or add the line for the "PermitRootLogin" keyword and set its value to "no":
PermitRootLogin no
The SSH daemon must be restarted for the changes to take effect. To restart the SSH daemon, run the following command:
$ sudo systemctl restart sshd.service