SecBaseline

Sample finding, sign in to explain your own rules and import scan results.

RHEL 9 baseline, Acme Federal System

RHEL 9 must disable direct root login via SSH.

CAT IOpenV-DEMO-0001SV-DEMO-0001r1_ruleRHEL-09-SSH-001

Check text

Verify that "PermitRootLogin" is set to "no" in /etc/ssh/sshd_config:

# grep -i permitrootlogin /etc/ssh/sshd_config

If the value is anything other than "no", or is commented out, this is a finding.

Fix text

Edit /etc/ssh/sshd_config and set:

PermitRootLogin no

Then restart the SSH service:

# systemctl restart sshd
Prepared example, written and reviewed by hand, not model-generated.

Plain-English summary

The SSH daemon must refuse login attempts that authenticate directly as the root account. Administrators sign in with their own named account and then escalate privileges with sudo.

Why it matters

Direct root login makes privileged activity unattributable, audit records show only "root", not the human behind the session. Requiring named accounts plus escalation preserves individual accountability and reduces the value of a single stolen credential.

Risk if unaddressed

A CAT I exposure: a brute-forced or leaked root password grants immediate, complete, and untraceable control of the host over the network, with no secondary authentication step and no reliable attribution in the audit trail.

Remediation guidance

  1. Edit /etc/ssh/sshd_config and set PermitRootLogin no (uncomment the directive if it is commented out).
  2. Confirm at least one non-root administrative account exists with working sudo access before applying the change.
  3. Validate the configuration syntax with sshd -t.
  4. Restart the SSH service: systemctl restart sshd.

Validation

  1. Run grep -i permitrootlogin /etc/ssh/sshd_config and confirm the effective value is no.
  2. Run sshd -T | grep -i permitrootlogin to confirm the running daemon's effective setting.
  3. From a remote host, attempt ssh root@<host> and confirm the attempt is refused.
  4. Confirm an administrative user can still authenticate and escalate with sudo.

NIST 800-53 mapping (via CCI)

AC-6AC-6(2)IA-2IA-2(5)
CCI-000770CCI-000225

Common pitfalls

  1. Setting PermitRootLogin prohibit-password and treating it as compliant, the STIG requires no.
  2. Leaving a duplicate directive later in sshd_config or in an Include'd drop-in file, which overrides the earlier value.
  3. Editing the file but never restarting sshd, so the running daemon keeps the old setting.
  4. Applying the change with no working sudo account, locking administrators out of the host.