Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The SSH daemon must restrict login ability to specific users and/or groups.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| GEN005521-ESXI5-000103 | GEN005521-ESXI5-000103 | GEN005521-ESXI5-000103_rule | Medium |
| Description |
|---|
| Restricting SSH logins to a limited group of users, such as system administrators, prevents password-guessing and other SSH attacks from reaching system accounts and other accounts not authorized for SSH access. |
| STIG | Date |
|---|---|
| VMware ESXi v5 Security Technical Implementation Guide | 2013-01-15 |
Details
| Check Text ( C-GEN005521-ESXI5-000103_chk ) |
|---|
| Disable lock down mode. Enable the ESXi Shell. Check the SSH daemon configuration for the AllowGroups setting. # grep -i "^AllowGroups" /etc/ssh/sshd_config If "AllowGroups" is not present in the file, this is a finding. Re-enable lock down mode. |
| Fix Text (F-GEN005521-ESXI5-000103_fix) |
|---|
| Disable lock down mode. Enable the ESXi Shell. Edit the SSH daemon configuration and add/modify the "AllowGroups" keyword in the configuration. # vi /etc/ssh/sshd_config Re-enable lock down mode. |