documentation_complete: true

title: 'Disable SSH Root Login'

description: |-
    The root user should never be allowed to login to a
    system directly over a network.
    To disable root login via SSH, add or correct the following line
    in <tt>/etc/ssh/sshd_config</tt>:
    <pre>PermitRootLogin no</pre>

rationale: |-
    Permitting direct root login reduces auditable information about who ran
    privileged commands on the system
    and also allows direct attack attempts on root's password.

severity: medium

identifiers:
    cce: 27100-7

references:
    disa: 770
    nist: AC-3,AC-6(2),IA-2(1)
    srg: SRG-OS-000109
    stigid: RHEL-06-000237

ocil: '<sshd-check-macro default="no" option="PermitRootLogin" value="no" />'
