# Ensure sshd Access Is Properly Configured

- Source: https://support.icompaas.com/support/solutions/articles/62000235412-ensure-sshd-access-is-properly-configured
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Linux 2 Benchmark v3.0.0](https://support.icompaas.com/support/solutions/62000112696) › [CIS Amazon Linux 2 Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169265)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability: • **Level 1**

Description:  
 Configuring the SSH daemon (sshd) access controls ensures only authorized users and hosts can connect to the system via SSH. Proper access configuration protects against unauthorized remote logins and potential security breaches.

Rationale:  
 Restricting sshd access mitigates unauthorized access risks by enforcing authentication methods, limiting user logins, and controlling allowed hosts or networks.

Impact:  
 **Pros**:

-   Enhances system security by controlling remote access.  
      
    
-   Supports compliance with access control policies.  
      
    

**Cons**:

-   Improper configuration may lock out legitimate users or services.  
      
    

Default Value:  
 Default sshd configurations allow wide access unless customized.

Pre-requisites:

-   Root or sudo privileges to modify SSH daemon configuration.  
      
    

Remediation:

### Test Plan:

Using Linux command line:

Review sshd configuration file:  

grep -E 'AllowUsers|AllowGroups|DenyUsers|DenyGroups|PermitRootLogin' /etc/ssh/sshd\_config

Check for configured access restrictions and authentication methods.  

### Implementation Plan:

Using Linux command line:

Edit /etc/ssh/sshd\_config to enforce access controls, for example:

PermitRootLogin no  
AllowUsers user1 user2  
PasswordAuthentication no  
PermitEmptyPasswords no  

Reload sshd service to apply changes:  

systemctl reload sshd

Verify sshd status:  

systemctl status sshd

### Backout Plan:

Using Linux command line:

1.  Revert changes in /etc/ssh/sshd\_config if necessary.
    
2.  Reload sshd service and verify accessibility.  
      
    

References

-   [NIST SP 800-53 Revision 5 - AC-17  
      
    ](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final#ac-17)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.