# Ensure sshd access is configured

Necessity: OpenSSH is a primary method for remote system administration. By default, any user with valid credentials can log in via SSH, which significantly increases the system's attack surface. If any user account is compromised, it can be used to gain remote access. Restricting SSH access to a specific, authorized set of users and groups adheres to the principle of least privilege, minimizing the risk of unauthorized access and lateral movement within the network.

Auditing and Remediation: The audit script verifies that an explicit access control policy is defined in the SSH daemon configuration file (`/etc/ssh/sshd_config`) by checking for the presence of `AllowUsers`, `AllowGroups`, `DenyUsers`, or `DenyGroups`. The remediation process involves manually defining and applying an appropriate access list. It is strongly recommended to use an allow-list (`AllowUsers` or `AllowGroups`) rather than a deny-list (`Deny*`), as deny-lists are brittle and can be bypassed if new, unauthorized accounts are created.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Configured'. This is a binary security control; it is either enforced or it is not. The differentiation between levels lies not in the setting's state, but in the strictness of the access list itself. A Basic policy might allow a general 'sysadmins' group, while a Strict policy would enumerate a minimal list of specific, named administrative accounts. Regardless of the implementation details, the fundamental security practice is to always have an explicit access control list configured.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Configured']` |
| **Moderate** | `['Configured']` |
| **Strict** | `['Configured']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the `/etc/ssh/sshd_config` file. The script should check for the presence of active (non-commented) `AllowUsers`, `AllowGroups`, `DenyUsers`, or `DenyGroups` directives. If any of these directives are found to be active, the script must return the string 'Configured'. If none of these directives are active, it must return 'Not Configured'. The output must be only the resulting string, with no additional text or formatting.

## Remediation Script Working

Bash script that modifies the `/etc/ssh/sshd_config` file. This is a highly sensitive setting that requires manual configuration of which users/groups to allow. The script should be designed to take two positional arguments: the directive (e.g., 'AllowUsers') and a space-separated string of names (e.g., 'admin root'). The script must add this line to the configuration file, removing any previous instances of the same directive, and then restart the sshd service. It must return 'true' on success and 'false' on failure. This script should be used with extreme caution to avoid locking out administrators.

