0022-sshd-restart SSHD Service Restarted¶

Rule ID¶

• 0022-sshd-restart

Category¶

• system

Severity¶

• critical

Compatible Versions¶

• Linux

Description¶

• Monitor if the sshd service has been restarted

Scan Frequency¶

• disable

Rationale¶

• In Linux system operations, it is common to connect to other hosts. The service that enables remote connections is openssh-server, which allows remote hosts to access the sshd service over the network. If the sshd service is restarted, the sshd configuration may have been maliciously modified.

Risk Items¶

• Hacker intrusion
• Data leakage
• Network security
• Cryptomining risk
• Botnet risk

Audit Method¶

• Verify whether the sshd service on the host has been restarted. You can run the following command to verify:

systemctl status sshd

Remediation¶

• If the sshd service has been restarted, review all configuration files under /etc/ssh/. Be sure to carefully examine the host environment for signs of intrusion, and change the host user password.

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• None