← Back to IBM AIX 7.x Security Technical Implementation Guide

V-215306

CAT II (Medium)

If AIX SSH daemon is required, the SSH daemon must only listen on the approved listening IP addresses.

Rule ID

SV-215306r991593_rule

STIG

IBM AIX 7.x Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000366

Discussion

The SSH daemon should only listen on the approved listening IP addresses. Otherwise the SSH service could be subject to unauthorized access.

Check Content

From the command prompt, run the following command to check if "ListenAddress" is defined in SSH config file:

# grep -i ListenAddress /etc/ssh/sshd_config | grep -v '^#'
ListenAddress  10.17.76.74

If no configuration is returned, or if a returned listen configuration contains addresses not permitted, this is a finding.

Fix Text

Edit the SSH daemon config file and add/modify the "ListenAddress" network addresses:
# vi /etc/ssh/sshd_config

Restart SSH daemon:
# stopsrc -s sshd
# startsrc -s sshd