0023-sshd - Whether the sshd configuration file has been modified¶

Rule ID¶

• 0023-sshd

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• Monitor whether the sshd configuration file has been modified.

Scan Frequency¶

• disable

Rationale¶

• In Linux system operations, it is often necessary to connect to other hosts. The service responsible for connecting to other hosts is openssh-server, which allows remote hosts to access the sshd service over the network. If the sshd configuration file is modified, it may have been maliciously altered.

Risk Items¶

• Hacker infiltration
• Data leakage
• Network security
• Cryptomining risk
• Botnet risk

Audit Method¶

• Verify whether the host's sshd configuration file has been modified. You can run the following command to verify:

ll /etc/ssh/sshd_config

Remediation¶

• If the sshd configuration file has been modified, carefully inspect the host environment to check whether it has been compromised, and change the host user password.

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• None