CME-901
SSH Hardening (Comprehensive)
Description
Comprehensive SSH hardening: disable root login, enforce Protocol 2, restrict ciphers to AEAD (chacha20/aes-gcm), disable X11/agent forwarding, set MaxAuthTries, enable LoginGraceTime.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Privileges Required (PR) | N → H | Root login disabled; strong auth required |
| Attack Complexity (AC) | L → H | Weak ciphers unavailable; forwarding attacks blocked |
CWE Relationships
Verification
Audit sshd configuration
$ sshd -T | grep -E 'permitrootlogin|maxauthtries|x11forwarding'
# Expected: permitrootlogin no
# Expected: permitrootlogin no
Platform: linux
Remediation
linux
SSH hardening via sshd_config.d drop-in
printf 'PermitRootLogin no\nMaxAuthTries 4\nX11Forwarding no\nAllowAgentForwarding no\nLoginGraceTime 60\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com\n' > /etc/ssh/sshd_config.d/99-cme-901-hardening.conf
sshd -t
systemctl reload sshd