← Back to IBM AIX 7.x Security Technical Implementation Guide

V-215293

CAT II (Medium)

AIX must setup SSH daemon to disable revoked public keys.

Rule ID

SV-215293r1009549_rule

STIG

IBM AIX 7.x Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-004068 CCI-001991

Discussion

Without configuring a local cache of revocation data, there is the potential to allow access to users who are no longer authorized (users with revoked certificates).

Check Content

If public keys are not used for SSH authentication, this is Not Applicable.

Run the following command:

# grep "^RevokedKeys" /etc/ssh/sshd_config
RevokedKeys     /etc/ssh/RevokedKeys.txt

If the command does not find the "RevokedKeys" setting, or the value for "RevokedKeys" is set to "none", this is a finding.

Fix Text

Obtain the file that contains all the public keys that need to be revoked from ISSO/SA and save the file in /etc/ssh/ directory.
 
Edit the "/etc/ssh/sshd_config" file to allow "RevokedKeys" to point to the revoked key file obtained above.

Restart the SSH daemon:
# stopsrc -s sshd
# startsrc -s sshd