# Ensure sshd access is configured

Necessity: By default, SSH access is permitted for all configured user accounts on a system. This creates a broad attack surface, as the compromise of any single user account could grant an attacker remote access. Implementing explicit access controls via directives like `AllowUsers` or `AllowGroups` enforces the principle of least privilege, ensuring that only authorized accounts can establish an SSH connection. This significantly reduces the risk of unauthorized access and lateral movement within a network.

Auditing and Remediation: The audit script checks the active SSH server configuration (`/etc/ssh/sshd_config`) to verify that an explicit access control policy is defined. It returns 'Configured' if any `Allow` or `Deny` rules for users or groups are in place. The remediation script implements such a policy by taking a specific directive as an argument (e.g., 'AllowUsers admin') and writing it to the configuration file, ensuring a whitelist of authorized users is enforced.

Recommended State Rationale: The recommended state across all levels is 'Configured' because failing to explicitly define SSH access is a critical security gap. 
- Basic: `['Configured']` represents the fundamental requirement to move away from the default 'allow all' posture. Any explicit rule is better than none.
- Moderate: `['Configured']` reinforces this requirement. At this level, organizations are expected to use group-based rules (e.g., `AllowGroups ssh_users`) for more scalable and manageable access control.
- Strict: `['Configured']` is the mandatory state for a hardened system. A strict implementation involves maintaining a minimal list of users or groups in the allow-list, adhering strictly to the principle of least privilege where only essential administrative accounts have SSH access.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Configured']` |
| **Moderate** | `['Configured']` |
| **Strict** | `['Configured']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the `/etc/ssh/sshd_config` file. The script must check if any of the directives `AllowUsers`, `DenyUsers`, `AllowGroups`, or `DenyGroups` are present, uncommented, and assigned a value. If at least one such directive is found, the script must output the string 'Configured'. Otherwise, it must output 'Not Configured'. The output must contain only one of these two strings and nothing else.

## Remediation Script Working

Bash script that accepts a single string argument, which is the full directive to be added (e.g., 'AllowUsers adminuser supportuser'). The script must add this line to `/etc/ssh/sshd_config`. To prevent conflicts, it should first remove any existing `AllowUsers`, `DenyUsers`, `AllowGroups`, or `DenyGroups` directives from the file. After successfully modifying the configuration, the script must reload the sshd service. The script must return `true` on success and `false` on failure.

