The SSH daemon must limit connections to a single session.

From HP-UX 11.31 Security Technical Implementation Guide

Part of GEN005533

Associated with IA controls: ECSC-1

Associated with: CCI-000054

SV-35135r1_rule The SSH daemon must limit connections to a single session.

Vulnerability discussion

The SSH protocol has the ability to provide multiple sessions over a single connection without reauthentication. A compromised client could use this feature to establish additional sessions to a system without consent or knowledge of the user.Alternate per-connection session limits may be documented if needed for a valid mission requirement. Greater limits are expected to be necessary in situations where TCP or X11 forwarding are used.

Check content

Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=MaxSessions arg(s)=1 Default values include: "10" Note: When the default "arg" value exactly matches the required "arg" value (see above), the entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "MaxSessions" If configuration information is not returned or the return value is greater than one (1), this is a finding.

Fix text

Edit the SSH daemon configuration and add or edit the MaxSessions setting value to 1.

Pro Tips

Powered by sagemincer