← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-12022

CAT II (Medium)

The SSH daemon must be configured for IP filtering.

Rule ID

SV-46108r1_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-000366

Discussion

The SSH daemon must be configured for IP filtering to provide a layered defense against connection attempts from unauthorized addresses.

Check Content

Check the TCP wrappers configuration files to determine if sshd is configured to use TCP wrappers.

Procedure:
# grep sshd /etc/hosts.deny
# grep sshd /etc/hosts.allow

If no entries are returned, the TCP wrappers are not configured for sshd, this is a finding.

Fix Text

Add appropriate IP restrictions for SSH to the /etc/hosts.deny and/or /etc/hosts.allow files.