← Back to IBM AIX 7.x Security Technical Implementation Guide

V-215297

CAT II (Medium)

AIX must turn on SSH daemon privilege separation.

Rule ID

SV-215297r991589_rule

STIG

IBM AIX 7.x Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000366

Discussion

SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would decrease the impact of software vulnerabilities in the unprivileged section.

Check Content

Check the SSH daemon configuration for the "UsePrivilegeSeparation" setting using command: 

# grep -i UsePrivilegeSeparation  /etc/ssh/sshd_config | grep -v '^#' 
UsePrivilegeSeparation yes

If the setting is not present or the setting is "no", this is a finding.

Fix Text

Edit the "/etc/sshd/sshd_config" file and add the following line:
UsePrivilegeSeparation yes

Restart the SSH daemon:
# stopsrc -s sshd
# startsrc -s sshd