CIS Microsoft Windows 10 Enterprise Release 1909 Benchmark

5.14 (L1) Ensure 'OpenSSH SSH Server (sshd)' is set to 'Disabled' or 'Not Installed' (Scored)

ProfileApplicability:

 Level 1 (L1) - Corporate/Enterprise Environment (general use)

Description:

SSH protocol based service to provide secure encrypted communications between two untrusted hosts over an insecure network.

The recommended state for this setting is: Disabled or Not Installed .

Note: This service is not installed by default. It is supplied withWindows, but it is installed by enabling an optional Windows feature ( OpenSSH Server ).

Rationale:

Hosting an SSH server from a workstation is an increased security risk, as the attack surface of that workstation is then greatly increased.

Note: This security concern applies to any SSH server application installed on a workstation, not just the one supplied withWindows.

Audit:

Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sshd:Start

Remediation:

To establish the recommended configuration via GP, set the following UI path to: Disabled :

Computer Configuration\Policies\Windows Settings\Security Settings\System Services\OpenSSH SSH Server

Impact:

The workstation will not be permitted to be a SSH host server.

Default Value:

Not Installed (Manual when installed)

322 | P a g e