SV-26763r1: The SSH daemon must restrict login ability to specific users and/or groups. | AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE

Loading benchmark…

Assessment Title

Rule Text

The SSH daemon must restrict login ability to specific users and/or groups.

Description

Discussion Text

Restricting SSH logins to a limited group of users, such as system administrators, prevents password-guessing and other SSH attacks from reaching system accounts and other accounts not authorized for SSH access.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000225

Additional Details

Responsibility

System Administrator

IA Controls

ECLP-1

References

DPMS Target AIX 6.1 DISA DPMS Target AIX 6.1 2176

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.aix11:def:311
# The SSH daemon must restrict login ability to specific users and/or groups.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# SSH daemon is configured to restrict logins to specific users and/or groups
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  grep -Pq '^[ 	]*[Aa][Ll][Ll][Oo][Ww]([Gg][Rr][Oo][Uu][Pp][Ss]|[Uu][Ss][Ee][Rr][Ss])[ 	]+[^ 	

]+' '/etc/ssh/sshd_config' &>/dev/null
}

if test_1; then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.aix11:def:311
path="/etc/ssh"
filename="sshd_config"
if [ ! -f "$path/$filename" ]; then echo "PASS"; exit 0; fi
content=$(cat "$path/$filename")
if grep -q "^[ \t]*[Aa][Ll][Ll][Oo][Ww]([Gg][Rr][Oo][Uu][Pp][Ss]|[Uu][Ss][Ee][Rr][Ss])[ \t]+[^ \t\n\r]+" "$path/$filename"; then echo "PASS"; exit 0; else echo "FAIL"; exit 1; fi

Remediation

Edit the SSH daemon configuration and add an AllowGroups directive.