https://secscan.acron.pl/ 2026-08-31T09:45:43+00:00 https://secscan.acron.pl/ https://secscan.acron.pl/lib/tpl/bootstrap3/images/favicon.ico text/html 2017-05-04T19:17:32+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/1?rev=1493918252&do=diff 5.2.1 Ensure permissions on /etc/ssh/sshd_config are configured (Scored) Profile Applicability Description The /etc/ssh/sshd_config file contains configuration specifications for sshd. The command below sets the owner and group of the file to root. text/html 2017-05-04T19:18:12+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/2?rev=1493918292&do=diff 5.2.2 Ensure SSH Protocol is set to 2 (Scored) Profile Applicability Description SSH supports two different and incompatible protocols: SSH1 and SSH2. SSH1 was the original protocol and was subject to security issues. SSH2 is more advanced and secure. text/html 2017-05-04T19:18:28+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/3?rev=1493918308&do=diff 5.2.3 Ensure SSH LogLevel is set to INFO (Scored) Profile Applicability Description The INFO parameter specifies that login and logout activity will be logged. Rationale SSH provides several logging levels with varying amounts of verbosity. DEBUG text/html 2017-05-04T19:19:54+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/4?rev=1493918394&do=diff 5.2.4 Ensure SSH X11 forwarding is disabled (Scored) Profile Applicability Description The X11Forwarding parameter provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections. Rationale Disable X11 forwarding unless there is an operational requirement to use X11 applications directly. There is a small risk that the remote X11 servers of users who are logged in via SSH with X11 forwarding could be compromised by other users on the X11 server. Note t… text/html 2017-05-04T19:20:18+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/5?rev=1493918418&do=diff 5.2.5 Ensure SSH MaxAuthTries is set to 4 or less (Scored) Profile Applicability Description The MaxAuthTries parameter specifies the maximum number of authentication attempts permitted per connection. When the login failure count reaches half the number, error messages will be written to the text/html 2017-05-04T19:20:34+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/6?rev=1493918434&do=diff 5.2.6 Ensure SSH IgnoreRhosts is enabled (Scored) Profile Applicability Description The IgnoreRhosts parameter specifies that .rhosts and .shosts files will not be used in RhostsRSAAuthentication or HostbasedAuthentication. Rationale Setting this parameter forces users to enter a password when authenticating with ssh. text/html 2017-05-04T19:20:54+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/7?rev=1493918454&do=diff 5.2.7 Ensure SSH HostbasedAuthentication is disabled (Scored) Profile Applicability Description The HostbasedAuthentication parameter specifies if authentication is allowed through trusted hosts via the user of .rhosts, or /etc/hosts.equiv, along with successful public key client host authentication. This option only applies to SSH Protocol Version 2. text/html 2017-05-04T19:21:10+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/8?rev=1493918470&do=diff 5.2.8 Ensure SSH root login is disabled (Scored) Profile Applicability Description The PermitRootLogin parameter specifies if the root user can log in using ssh(1). The default is no. Rationale Disallowing root logins over SSH requires system admins to authenticate using their own individual account, then escalating to root via text/html 2017-05-04T19:21:28+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/9?rev=1493918488&do=diff 5.2.9 Ensure SSH PermitEmptyPasswords is disabled (Scored) Profile Applicability Description The PermitEmptyPasswords parameter specifies if the SSH server allows login to accounts with empty password strings. Rationale Disallowing remote shell access to accounts that have an empty password reduces the probability of unauthorized access to the system text/html 2017-05-04T19:22:14+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/10?rev=1493918534&do=diff 5.2.10 Ensure SSH PermitUserEnvironment is disabled (Scored) Profile Applicability Description The PermitUserEnvironment option allows users to present environment options to the ssh daemon. Rationale Permitting users the ability to set environment variables through the SSH daemon could potentially allow users to bypass security controls (e.g. setting an execution path that has text/html 2017-05-04T19:24:44+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/11?rev=1493918684&do=diff 5.2.11 Ensure only approved ciphers are used (Scored) Profile Applicability Description This variable limits the types of ciphers that SSH can use during communication. Rationale Based on research conducted at various institutions, it was determined that the symmetric portion of the SSH Transport Protocol (as described in text/html 2017-05-04T19:23:26+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/12?rev=1493918606&do=diff 5.2.12 Ensure only approved MAC algorithms are used (Scored) Profile Applicability Description This variable limits the types of MAC algorithms that SSH can use during communication. Rationale MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of attention as a weak spot that can be exploited with expanded computing power. An attacker that breaks the algorithm could take adv… text/html 2017-05-04T19:25:22+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/13?rev=1493918722&do=diff 5.2.13 Ensure SSH Idle Timeout Interval is configured (Scored) Profile Applicability Description The two options ClientAliveInterval and ClientAliveCountMax control the timeout of ssh sessions. When the ClientAliveInterval variable is set, ssh sessions that have no activity for the specified length of time are terminated. When the text/html 2017-05-04T19:25:50+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/14?rev=1493918750&do=diff 5.2.14 Ensure SSH LoginGraceTime is set to one minute or less (Scored) Profile Applicability Description The LoginGraceTime parameter specifies the time allowed for successful authentication to the SSH server. The longer the Grace period is the more open unauthenticated connections can exist. Like other session controls in this session the Grace Period should be limited to appropriate organizational limits to ensure the service is available for needed access. text/html 2017-05-04T19:26:12+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/15?rev=1493918772&do=diff 5.2.15 Ensure SSH access is limited (Scored) Profile Applicability Description There are several options available to limit which users and group can access the system via SSH. It is recommended that at least one of the following options be leveraged: text/html 2017-05-04T19:26:36+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/5/2/16?rev=1493918796&do=diff 5.2.16 Ensure SSH warning banner is configured (Scored) Profile Applicability Description The Banner parameter specifies a file whose contents must be sent to the remote user before authentication is permitted. By default, no banner is displayed.