documentation_complete: true

title: 'Enable Use of Strict Mode Checking'

description: |-
    SSHs <tt>StrictModes</tt> option checks file and ownership permissions in
    the user's home directory <tt>.ssh</tt> folder before accepting login. If world-
    writable permissions are found, logon is rejected.
    <br/>
    The default SSH configuration has <tt>StrictModes</tt> enabled. The appropriate
    configuration is used if no value is set for <tt>StrictModes</tt>.
    <br/>
    To explicitly enable <tt>StrictModes</tt> in SSH, add or correct the following line in
    {{{ sshd_config_file() }}}
    <pre>StrictModes yes</pre>

rationale: |-
    If other users have access to modify user-specific SSH configuration files, they
    may be able to log into the system as another user.

severity: medium

identifiers:
    cce@rhel8: CCE-80904-6
    cce@rhel9: CCE-90809-5
    cce@rhel10: CCE-88037-7
    cce@sle12: CCE-83060-4
    cce@sle15: CCE-85645-0
    cce@sle16: CCE-95844-7
    cce@slmicro5: CCE-93647-6
    cce@slmicro6: CCE-95071-7 

references:
    cis-csc: 12,13,14,15,16,18,3,5
    cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
    cui: 3.1.12
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
    isa-62443-2009: 4.3.3.7.3
    isa-62443-2013: 'SR 2.1,SR 5.2'
    iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
    nerc-cip: CIP-003-8 R5.1.1,CIP-003-8 R5.3,CIP-004-6 R2.3,CIP-007-3 R2.1,CIP-007-3 R2.2,CIP-007-3 R2.3,CIP-007-3 R5.1,CIP-007-3 R5.1.1,CIP-007-3 R5.1.2
    nist: AC-6,AC-17(a),CM-6(a)
    nist-csf: PR.AC-4,PR.DS-5
    srg: SRG-OS-000480-GPOS-00227
    stigid@ol7: OL07-00-040450
    stigid@ol8: OL08-00-010500
    stigid@sle12: SLES-12-030230
    stigid@sle15: SLES-15-040260

{{{ complete_ocil_entry_sshd_option(default="yes", option="StrictModes", value="yes") }}}

fixtext: '{{{ fixtext_sshd_lineinfile("StrictModes", "yes", "no") }}}'

srg_requirement: 'The {{{ full_name }}} SSH daemon must perform strict mode checking of home directory configuration files.'

template:
    name: sshd_lineinfile
    vars:
        parameter: StrictModes
        value: 'yes'
        datatype: string
        is_default_value: 'true'
