The HYCU VM/server must be configured to disable SSH.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-246829	HYCU-AC-000011	SV-246829r790582_rule		Medium

Description
It is detrimental for applications to provide functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Examples of non-essential capabilities include but are not limited to software packages, tools, and demonstration software not related to requirements or providing a wide array of functionality not required for every mission but that cannot be disabled. Remote access using SSH is not required for administration as all administrative tasks can be performed either through the web interface or local console. SSH must be disabled to limit exposure.

Description

It is detrimental for applications to provide functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Examples of non-essential capabilities include but are not limited to software packages, tools, and demonstration software not related to requirements or providing a wide array of functionality not required for every mission but that cannot be disabled. Remote access using SSH is not required for administration as all administrative tasks can be performed either through the web interface or local console. SSH must be disabled to limit exposure.

STIG	Date
HYCU for Nutanix Security Technical Implementation Guide	2021-08-03

Details

Check Text ( C-50261r768149_chk )
Verify the SSHD daemon has been disabled using the following command: $ sudo systemctl status sshd Loaded: loaded (/usr/lib/systemd/system/sshd.service; disabled) Active: inactive (dead) If the SSHD daemon is not disabled and inactive or is not documented and approved for use, this is a finding.

Fix Text (F-50215r768150_fix)
Stop the SSHD daemon: $ sudo systemctl stop sshd Disable the SSHD daemon: $ sudo systemctl disable sshd Note: The service must be stopped before it can be disabled.