documentation_complete: true

title: 'Enable Use of Privilege Separation'

description: |-
    When enabled, SSH will create an unprivileged child process that
    has the privilege of the authenticated user. To enable privilege separation in
    SSH, add or correct the following line in the <tt>/etc/ssh/sshd_config</tt> file:
    <pre>UsePrivilegeSeparation {{{ xccdf_value("var_sshd_priv_separation") }}}</pre>

rationale: |-
    SSH daemon privilege separation causes the SSH process to drop root privileges
    when not needed which would decrease the impact of software vulnerabilities in
    the unprivileged section.

severity: medium

identifiers:
    cce@rhel8: CCE-80908-7
    cce@rhel9: CCE-88822-2
    cce@rhel10: CCE-88712-5
    cce@sle12: CCE-83061-2
    cce@sle15: CCE-85646-8
    cce@sle16: CCE-96639-0

references:
    cis-csc: 12,13,14,15,16,18,3,5
    cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
    cui: 3.1.12
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
    isa-62443-2009: 4.3.3.7.3
    isa-62443-2013: 'SR 2.1,SR 5.2'
    iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
    nerc-cip: CIP-003-8 R5.1.1,CIP-003-8 R5.3,CIP-004-6 R2.3,CIP-007-3 R2.1,CIP-007-3 R2.2,CIP-007-3 R2.3,CIP-007-3 R5.1,CIP-007-3 R5.1.1,CIP-007-3 R5.1.2
    nist: CM-6(a),AC-17(a),AC-6
    nist-csf: PR.AC-4,PR.DS-5
    srg: SRG-OS-000480-GPOS-00227
    stigid@ol7: OL07-00-040460
    stigid@sle12: SLES-12-030240
    stigid@sle15: SLES-15-040270

ocil_clause: 'it is commented out or is not enabled'

ocil: |-
    To check if UsePrivilegeSeparation is enabled or set correctly, run the
    following command:
    <pre>$ sudo grep UsePrivilegeSeparation /etc/ssh/sshd_config</pre>
    If configured properly, output should be <tt>{{{ xccdf_value("var_sshd_priv_separation") }}}</tt>.

platform: package[openssh-server]<7.5

template:
    name: sshd_lineinfile
    vars:
        parameter: UsePrivilegeSeparation
        xccdf_variable: var_sshd_priv_separation
        datatype: string
