DET-H13: Root SSH login policy changed¶
sshd's PermitRootLogin changed between two collector snapshots. A change that loosens root SSH access (e.g. to 'yes') widens the host's interactive-access surface.
| Property | Value |
|---|---|
| Severity | high |
| Platform | Hardware fleets |
| Group | hardware |
| Log source | Collector · sshd_config |
| Related check | SSH-01: Remote access hardening |
Fires when¶
sshd_config PermitRootLogin loosened between collector snapshots
How it runs¶
The hosted service evaluates this rule on what enrolled collectors report and on key-release decisions. There is nothing to run; see Enroll a collector.
A match appears in the console as a detection with this rule's ID and triggers your alerts; see Runtime detections.