10.3 Secure Shell, Administrative Accounts, and Console Access
For remote connections, all hardened appliances include the Secure Shell (SSH). Because many appliances do not include default user accounts, the root account might still be able to directly log in through SSH.
To meet the compliance standards for nonrepudiation, the SSH server on all hardened appliances comes preconfigured with the “AllowGroups wheel” entry to restrict SSH access to the secondary group wheel.
Note For separation of duties, the “AllowGroups wheel” entry can be modified in /etc/ssh/sshd_config to use another group (such as sshd). The wheel group is enabled with the pam_wheel module for superuser access, so members of the wheel group are allowed to su – to root (password for root is required).
Group separation provides a method for users to SSH to the appliance, but not have the ability to su to root. For proper appliance functionality, do not remove or modify other entries in the AllowGroups field. Any change will require a restart of the SSH daemon.
Prior to removing root SSH access, create the local administrative accounts that can both use SSH and/or are members of the secondary wheel group.
Direct root login to SSH is removed by modifying the /etc/ssh/sshd_config file, setting the PermitRootLogin to no, and restarting sshd.
Restrict SSH access with the proper entries to limit access. All VMware virtual appliances include the tcp_wrappers package to allow TCP supported daemons to control the network subnets that can access the libwrapped daemons.
By default, the /etc/hosts.allow file contains a generic entry to allow all access to the secure shell:
sshd: ALL : ALLOW
VMware recommends that this entry be changed for production environments to include only the localhost entries and the management network subnet for secure operations, such as:
sshd: 127.0.0.1 : ALLOW
sshd: [::1] : ALLOW
sshd: 10.0.0. : ALLOW
This example will allow all localhost connections and connections made by clients on the 10.0.0.0 subnet.
By default, the hardened appliances allow direct login to root through the console. After administrative accounts have been created for non-repudiation and tested for wheel access (su – root), direct root logins can be disabled by editing the /etc/securetty file as root and replacing the entry
tty1
with
console
Design Considerations
Consider implementing the following if compliance with the STIG is required, or policy dictates it:
• Create user-specific administrative accounts for users that need to log in to a command shell.
• Remove ability for the root user to log in through SSH or the appliance console.
• Use tcp_wrappers to limit SSH connections to hosts on the management network.