← All control domains
SSH: 37 controls for Linux hardening
Pavois audits 37 controls in the SSH hardening domain, across 9 systems and 5 standards (CIS, ANSSI BP-028, NIST 800-53, PCI DSS, DISA STIG). Every control declares the evidence it gathers, its severity, its remediation and its standard references.
The domain in figures
| Controls | 37 |
| Severities | |
| Evidence gathered | |
| Standards | |
| Systems | Debian 12Debian 13FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8RHEL 9 / Rocky 9 / AlmaLinux 9Ubuntu 22.04Ubuntu 24.04Ubuntu 26.04 |
| Coverage depth | in depth |
What does Pavois check in this domain?
- effective runtime 37
- Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Which standards does this domain cover?
One effective-configuration check serves as evidence for several standards at once. The references below are the ones the corpus actually carries, never a claimed equivalence. how to read a standard mapping.
- CIS
- 2.2.6, 2.2.7, 5.1.5, 5.1.6, 5.1.7, 5.1.8, 5.1.9, 5.1.10, 5.1.11, 5.1.12, 5.1.13, 5.1.14, 5.1.15, 5.1.16, 5.1.17, 5.1.18, 5.1.19, 5.1.20, 5.1.21, 5.1.22, 5.1.23, 5.1.24, 8.2.8
- ANSSI BP-028
- R33
- NIST 800-53
- 3.1.1, 3.1.9, 3.1.11, 3.1.12, AC-2(5), AC-6(2), AC-8(a), AC-8(c), AC-12, AC-17 (2), AC-17(1), AC-17(2), AC-17(a), CM-6(a), CM-7(a), CM-7(b), IA-2, IA-2(5), SC-10
- PCI DSS
- 2.2.6, 2.2.7, 8.2.8
- DISA STIG
- UBTU-22-255020, UBTU-22-255025, UBTU-22-255030, UBTU-22-255035, UBTU-22-255050, UBTU-22-255055, UBTU-22-255060, UBTU-22-255065, UBTU-22-612020, UBTU-24-100830, UBTU-24-200640, UBTU-24-300031, UBTU-24-400030, UBTU-24-500050, UBTU-24-600000, UBTU-24-600010