{"description": "When enabled, SSH will create an unprivileged child process that\nhas the privilege of the authenticated user. To enable privilege separation in\nSSH, add or correct the following line in the <tt>/etc/ssh/sshd_config</tt> file:\n<pre>UsePrivilegeSeparation <sub idref=\"var_sshd_priv_separation\" /></pre>", "rationale": "SSH daemon privilege separation causes the SSH process to drop root privileges\nwhen not needed which would decrease the impact of software vulnerabilities in\nthe unprivileged section.", "severity": "medium", "references": {"cis-csc": ["12", "13", "14", "15", "16", "18", "3", "5"], "cobit5": ["APO01.06", "DSS05.04", "DSS05.07", "DSS06.02"], "cui": ["3.1.12"], "hipaa": ["164.308(a)(4)(i)", "164.308(b)(1)", "164.308(b)(3)", "164.310(b)", "164.312(e)(1)", "164.312(e)(2)(ii)"], "isa-62443-2009": ["4.3.3.7.3"], "isa-62443-2013": ["SR 2.1", "SR 5.2"], "iso27001-2013": ["A.10.1.1", "A.11.1.4", "A.11.1.5", "A.11.2.1", "A.13.1.1", "A.13.1.3", "A.13.2.1", "A.13.2.3", "A.13.2.4", "A.14.1.2", "A.14.1.3", "A.6.1.2", "A.7.1.1", "A.7.1.2", "A.7.3.1", "A.8.2.2", "A.8.2.3", "A.9.1.1", "A.9.1.2", "A.9.2.3", "A.9.4.1", "A.9.4.4", "A.9.4.5"], "nerc-cip": ["CIP-003-8 R5.1.1", "CIP-003-8 R5.3", "CIP-004-6 R2.3", "CIP-007-3 R2.1", "CIP-007-3 R2.2", "CIP-007-3 R2.3", "CIP-007-3 R5.1", "CIP-007-3 R5.1.1", "CIP-007-3 R5.1.2"], "nist": ["CM-6(a)", "AC-17(a)", "AC-6"], "nist-csf": ["PR.AC-4", "PR.DS-5"], "srg": ["SRG-OS-000480-GPOS-00227"]}, "control_references": {}, "components": [], "identifiers": {}, "ocil_clause": "it is commented out or is not enabled", "ocil": "To check if UsePrivilegeSeparation is enabled or set correctly, run the\nfollowing command:\n<pre>$ sudo grep UsePrivilegeSeparation /etc/ssh/sshd_config</pre>\nIf configured properly, output should be <tt><sub idref=\"var_sshd_priv_separation\" /></tt>.", "oval_external_content": null, "fixtext": "", "checktext": "", "vuldiscussion": "", "srg_requirement": "", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {"stig": {"srg_requirement": "Ubuntu 22.04 SSH daemon must be configured to use privilege separation.", "fixtext": "Configure the SSH daemon to perform privilege separation.\n\nAdd the following line in \"/etc/ssh/sshd_config\", or uncomment the line and set the value to \"yes\" or \"sandbox\":\n\nUsePrivilegeSeparation sandbox\n\nThe SSH service must be restarted for changes to take effect:\n\n$ sudo systemctl restart sshd.service", "checktext": "Verify the SSH daemon performs privilege separation with the following command:\n\n$ sudo /usr/sbin/sshd -dd 2&gt;&1 | awk '/filename/ {print $4}' | tr -d '\\r' | tr '' ' ' | xargs sudo grep -iH '^\\s*useprivilegeseparation'\n\nUsePrivilegeSeparation sandbox\n\nIf the \"UsePrivilegeSeparation\" keyword is set to \"no\", the returned line is commented out, or no output is returned, this is a finding.", "vuldiscussion": "SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would decrease the impact of software vulnerabilities in the nonprivileged section."}}, "platform": null, "platforms": [], "sce_metadata": {}, "inherited_platforms": ["system_with_kernel"], "cpe_platform_names": [], "inherited_cpe_platform_names": ["system_with_kernel"], "bash_conditional": null, "fixes": {}, "title": "Enable Use of Privilege Separation", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/services/ssh/ssh_server/sshd_use_priv_separation/rule.yml", "template": {"name": "sshd_lineinfile", "vars": {"parameter": "UsePrivilegeSeparation", "xccdf_variable": "var_sshd_priv_separation", "datatype": "string"}, "backends": {}}}