3.6.1.10 OpenSSH - configure sftp-server

Information

The sftp-server is started by the sshd server after authentication has been completed successfully. The process runs with the euid of the authenticated user.

Rationale:

SSH provides several logging levels with varying amounts of verbosity. DEBUG is specifically not recommended other than strictly for debugging SSH communications since it provides so much data that it is difficult to identify important security information. INFO level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.

Like sshd (see Recommendation: OpenSSH: LogLevel) the sftp-server needs to be configured with syslog information. Additionally, the umask value needs specification.

Solution

Edit the /etc/ssh/sshd_config:

vi /etc/ssh/sshd_config

Set:

Subsystem sftp /usr/sbin/sftp-server -u 027 -f AUTH -l VERBOSE

or

Subsystem sftp /usr/sbin/sftp-server -u 027 -f AUTH -l DEBUG

Re-cycle the sshd daemon to pick up the configuration changes:

stopsrc -s sshd
sleep 5
startsrc -s sshd

See Also

https://workbench.cisecurity.org/files/4119

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: f8c07c79c3626474b03749577b851b737f39f191b490e6e477159b13da6b1101