Sample scan
acme-app-01 – read-only demonstration data
| Rec | Title | Level | Status |
|---|---|---|---|
| 5.2.10 | Ensure SSH root login is disabled | Level 1 | Fail |
| 3.5.1.1 | Ensure a host-based firewall is installed and enabled | Level 1 | Fail |
| 1.1.2.5.1 | Ensure separate partition exists for /var/log | Level 2 | Fail |
| 5.4.1.6 | Ensure periodic review of user accounts and access is performed | Level 1 | Review |
| 6.2.1.1 | Ensure auditd package is installed and the service is enabled | Level 2 | Pass |
| 2.2.1 | Ensure X Window System is not installed | Level 1 | Fail |
Ensure SSH root login is disabled
5 Access, Authentication and Authorization
The PermitRootLogin parameter specifies if the root user can log in using SSH.
Disallowing root logins over SSH requires administrators to authenticate with an individual account, then escalate, preserving accountability.
Automation that authenticates directly as root over SSH will fail.
Run: sshd -T | grep -i permitrootlogin – verify output is 'permitrootlogin no'.
Edit /etc/ssh/sshd_config and set: PermitRootLogin no. Restart sshd.
Plain-English summary
The PermitRootLogin parameter specifies if the root user can log in using SSH.
Why it matters
Disallowing root logins over SSH requires administrators to authenticate with an individual account, then escalate, preserving accountability.
Risk if unaddressed
Disallowing root logins over SSH requires administrators to authenticate with an individual account, then escalate, preserving accountability.
Operational impact – what this may break
Only affects direct root SSH sessions. Confirm break-glass and automation accounts use named users with sudo first.
Remediation guidance
- Edit /etc/ssh/sshd_config and set: PermitRootLogin no. Restart sshd.
Validation
Run: sshd -T | grep -i permitrootlogin – verify output is 'permitrootlogin no'.
Framework mapping
Common pitfalls
Not provided.