CME-901
SSH Hardening (Comprehensive)
Description
Comprehensive SSH hardening: disable root login, enforce Protocol 2, restrict ciphers to AEAD (chacha20/aes-gcm), disable X11/agent forwarding, set MaxAuthTries, enable LoginGraceTime.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Privileges Required (PR) | N → H | Root login disabled; strong auth required |
| Attack Complexity (AC) | L → H | Weak ciphers unavailable; forwarding attacks blocked |
CWE Relationships
Verification
Audit sshd configuration
$ sshd -T | grep -E 'permitrootlogin|maxauthtries|x11forwarding'
# Expected: permitrootlogin no
# Expected: permitrootlogin no
Platform: linux