# File processed by the build system, i.e. retrieved from the build/rhel7/rules/sshd_disable_root_login.yml
description: 'The root user should never be allowed to login to a

  system directly over a network.

  To disable root login via SSH, add or correct the following line

  in <tt>/etc/ssh/sshd_config</tt>:

  <pre>PermitRootLogin no</pre>'
identifiers: {cce@rhel7: CCE-27445-6, cce@rhel8: CCE-80901-2}
ocil: 'To determine how the SSH daemon''s <tt>PermitRootLogin</tt> option is set,
  run the following command:

  <pre>$ sudo grep -i PermitRootLogin /etc/ssh/sshd_config</pre>


  If a line indicating <tt>no</tt> is returned, then the required value is set.

  '
ocil_clause: the required value is not set
oval_external_content: null
platforms: null
rationale: 'Even though the communications channel may be encrypted, an additional
  layer of

  security is gained by extending the policy of not logging directly on as root.

  In addition, logging in with a user-specific account provides individual

  accountability of actions performed on the system and also helps to minimize

  direct attack attempts on root''s password.'
references: {cis: 5.2.8, cis-csc: '1,11,12,13,14,15,16,18,3,5',
  cjis: 5.5.6, cobit5: 'APO01.06,DSS05.02,DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.02,DSS06.03,DSS06.06,DSS06.10',
  cui: '3.1.1, 3.1.5', hipaa: '164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)',
  isa-62443-2009: '4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4',
  isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR
    1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR
    5.2', iso27001-2013: 'A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.18.1.4,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5',
  nist: 'AC-3,AC-6(2),AC-17(b),IA-2,IA-2(5)', nist-csf: 'PR.AC-1,PR.AC-4,PR.AC-6,PR.AC-7,PR.DS-5,PR.PT-3',
  ospp: FIA_UAU.1, srg: SRG-OS-000480-GPOS-00227,
  stigid@rhel7: 'RHEL-07-040370'}
severity: medium
title: Disable SSH Root Login
warnings: []
