documentation_complete: true

title: 'Disable SSH Root Login'

description: |-
    The root user should never be allowed to login to a
    system directly over a network.
    To disable root login via SSH, add or correct the following line in
    {{{ sshd_config_file() }}}
    <pre>PermitRootLogin no</pre>

rationale: |-
    Even though the communications channel may be encrypted, an additional layer of
    security is gained by extending the policy of not logging directly on as root.
    In addition, logging in with a user-specific account provides individual
    accountability of actions performed on the system and also helps to minimize
    direct attack attempts on root's password.

severity: medium

identifiers:
    cce@rhcos4: CCE-89550-8
    cce@rhel8: CCE-80901-2
    cce@rhel9: CCE-90800-4
    cce@rhel10: CCE-89730-6
    cce@sle12: CCE-83035-6
    cce@sle15: CCE-85557-7
    cce@sle16: CCE-96675-4
    cce@slmicro5: CCE-93644-3
    cce@slmicro6: CCE-94674-9

references:
    cis-csc: 1,11,12,13,14,15,16,18,3,5
    cis@sle12: 5.2.10
    cis@sle15: 5.2.10
    cjis: 5.5.6
    cobit5: APO01.06,DSS05.02,DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.02,DSS06.03,DSS06.06,DSS06.10
    cui: '3.1.1,3.1.5'
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
    isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4
    isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR 5.2'
    iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.18.1.4,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5
    nerc-cip: CIP-003-8 R5.1.1,CIP-003-8 R5.3,CIP-004-6 R2.2.3,CIP-004-6 R2.3,CIP-007-3 R2.1,CIP-007-3 R2.2,CIP-007-3 R2.3,CIP-007-3 R5.1,CIP-007-3 R5.1.1,CIP-007-3 R5.1.2,CIP-007-3 R5.2,CIP-007-3 R5.3.1,CIP-007-3 R5.3.2,CIP-007-3 R5.3.3
    nist: AC-6(2),AC-17(a),IA-2,IA-2(5),CM-7(a),CM-7(b),CM-6(a)
    nist-csf: PR.AC-1,PR.AC-4,PR.AC-6,PR.AC-7,PR.DS-5,PR.PT-3
    ospp: FAU_GEN.1
    pcidss: Req-2.2.4
    srg: SRG-OS-000109-GPOS-00056,SRG-OS-000480-GPOS-00227,SRG-APP-000148-CTR-000335,SRG-APP-000190-CTR-000500
    stigid@ol7: OL07-00-040370
    stigid@ol8: OL08-00-010550
    stigid@sle12: SLES-12-030140
    stigid@sle15: SLES-15-020040

{{{ complete_ocil_entry_sshd_option(default="no", option="PermitRootLogin", value="no") }}}

platforms:
{{{ rule_notapplicable_when_ovirt_installed() | indent(4)}}}

warnings:
{{{ warning_ovirt_rule_notapplicable("RHV hosts require root access to be managed by RHV Manager") | indent(4) }}}

fixtext: |-
    {{{ fixtext_sshd_lineinfile("PermitRootLogin", "no", "no") }}}

srg_requirement: '{{{ full_name }}} must not permit direct logons to the root account using remote access via SSH.'

template:
    name: sshd_lineinfile
    vars:
        parameter: PermitRootLogin
        value: 'no'
        datatype: string
