MEDIUM RHCOS (Node) M1: SSHD Configuration P2

PASS (vanilla RHCOS 9.8+) Scanned: 2026-08-12 Synced: 2026-06-30

All 7 SSHD settings (PermitRootLogin, GSSAPIAuthentication, IgnoreRhosts, etc.) are already set to hardened defaults in RHCOS 10.2 (OCP 5.0). No MachineConfig needed. OCP 4.22 and earlier still require remediation.

No remediation needed on RHCOS 10.2+ (OCP 5.0+). These checks PASS on vanilla RHCOS 10.2 due to hardened OS defaults shipped in that version. Older RHCOS versions (9.6 and earlier) still require remediation. Verified with compliance-operator v1.8.2 and pinned content quay.io/bapalm/k8scontent:v0.1.80.

Overview

This remediation applies comprehensive SSH daemon hardening settings to improve security posture.

Settings

Setting	Value	Description
`PermitRootLogin`	`no`	Disable direct root SSH access
`GSSAPIAuthentication`	`no`	Disable GSSAPI authentication
`IgnoreRhosts`	`yes`	Disable rhost authentication
`IgnoreUserKnownHosts`	`yes`	Ignore user’s known_hosts file
`PermitUserEnvironment`	`no`	Block user environment variable passing
`StrictModes`	`yes`	Enable strict mode checking
`PrintLastLog`	`yes`	Display last login information

Implementation

The remediation applies a MachineConfig with SSHD hardening:

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  name: 75-sshd-medium
  labels:
    machineconfiguration.openshift.io/role: master
spec:
  config:
    ignition:
      version: 3.2.0
    storage:
      files:
        - path: /etc/ssh/sshd_config.d/75-medium-hardening.conf
          mode: 0600
          overwrite: true
          contents:
            inline: |
              # MEDIUM severity SSHD settings
              PermitRootLogin no
              GSSAPIAuthentication no
              IgnoreRhosts yes
              IgnoreUserKnownHosts yes
              PermitUserEnvironment no
              StrictModes yes
              PrintLastLog yes

Compliance Checks Remediated

This group addresses 7 compliance checks:

Check	Profile	Description	Docs
`rhcos4-e8-worker-sshd-disable-root-login`	E8	Disable root SSH login	📖
`rhcos4-e8-worker-sshd-disable-gssapi-auth`	E8	Disable GSSAPI authentication	📖
`rhcos4-e8-worker-sshd-disable-rhosts`	E8	Disable rhosts authentication	📖
`rhcos4-e8-worker-sshd-disable-user-known-hosts`	E8	Ignore user known_hosts	📖
`rhcos4-e8-worker-sshd-do-not-permit-user-env`	E8	Block user environment	📖
`rhcos4-e8-worker-sshd-enable-strictmodes`	E8	Enable strict modes	📖
`rhcos4-e8-worker-sshd-print-last-log`	E8	Print last login	📖

Source Remediation Files

medium/rhcos4-e8-worker-sshd-disable-root-login.yaml
medium/rhcos4-e8-worker-sshd-disable-gssapi-auth.yaml
medium/rhcos4-e8-worker-sshd-disable-rhosts.yaml
medium/rhcos4-e8-worker-sshd-disable-user-known-hosts.yaml
medium/rhcos4-e8-worker-sshd-do-not-permit-user-env.yaml
medium/rhcos4-e8-worker-sshd-enable-strictmodes.yaml
medium/rhcos4-e8-worker-sshd-print-last-log.yaml

Verification

After applying the MachineConfig, verify SSHD settings:

oc debug node/<node-name> -- chroot /host sshd -T | grep -E "permitrootlogin|gssapiauthentication|ignorerhosts"
# Expected output:
# permitrootlogin no
# gssapiauthentication no
# ignorerhosts yes

Other SSHD hardening groups:

H3: SSHD Empty Passwords - HIGH severity (in progress)
L1: SSHD LogLevel - LOW severity (pending)

← H3 All Groups M2 →