ASD ISM 0487 Disable certain features for passwordless SSH logins
What it says
When using logins without a password for SSH connections, the following are disabled: - access from IP addresses that do not require access - port forwarding - agent credential forwarding - X11 forwarding - console access.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWhen logging in without a password via SSH, certain access features like port forwarding and X11 are disabled to enhance security.
This control is about making sure certain features are turned off when people connect to your systems without a password using SSH (a way to remotely log in to computers). By turning off features like port forwarding and X11 forwarding, you reduce the risk of someone using these features to gain unauthorised access to your network or perform harmful actions.
Free. Save your status, tasks and notes.
Why it matters
If passwordless SSH features (port/X11/agent/console/unauthorised IP access) aren't disabled, attackers can pivot and access internal systems covertly.
How to implement
System administrators should configure the server settings to disable port forwarding for passwordless SSH logins.
This can be done by editing the SSH configuration file to include 'AllowTcpForwarding no'. Save the changes and restart the SSH service to apply them.
The IT team should ensure X11 forwarding is disabled for passwordless SSH sessions.
Edit the SSH configuration file to set 'X11Forwarding no', save the file, and restart the SSH service.
Network security personnel should disable agent forwarding for passwordless SSH.
This involves setting 'AllowAgentForwarding no' in the SSH configuration file, saving the changes, and restarting the SSH service.
System owners need to regularly review the list of IP addresses allowed to connect via SSH.
Ensure only necessary and authorised IP addresses are listed, and remove any outdated or unnecessary entries.
The IT security team should disable console access for passwordless SSH by configuring the system to deny shell access for passwordless logins, ensuring users cannot open an interactive shell session.
Keep it running
Regularly review sshd_config and SSH key options (from=, no-port-forwarding, no-agent-forwarding, no-X11-forwarding, no-pty) to keep passwordless logins restricted.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The SSH server configuration file: Request a copy or a demonstration of the SSH configuration file for the systems in question.
Look at
Settings like 'AllowTcpForwarding', 'X11Forwarding', and 'AllowAgentForwarding'.
Good evidence
Shows all these settings as 'no' for passwordless SSH.
- Check 2 of 5What an auditor asks for
Ask for
A list of authorised IP addresses: Request a current list of IP addresses permitted to connect via SSH without a password.
Look at
The range of IPs and confirm they are current and necessary.
Good evidence
Means all listed IPs are documented and have been reviewed recently.
- Check 3 of 5What an auditor asks for
Ask for
Logs of SSH connection attempts: Request recent connection logs to see which IP addresses have attempted or succeeded in passwordless logins.
Look at
Entries that match the authorised list.
Good evidence
Shows that only authorised IPs are connecting.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of configuration changes: Request documentation or logs that show when the SSH configuration was last changed.
Look at
Dates and details of any changes made.
Good evidence
Includes recent updates to disable forwarding features.
- Check 5 of 5What an auditor asks for
Ask for
System access policy reviews: Request documents or meeting notes from regular reviews of system access policies.
Look at
Sections that discuss SSH access rules and any adjustments made.
Good evidence
Will show regular assessments and updates.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
ISM-0487 requires organisations to harden passwordless SSH logins by disabling specific SSH capabilities such as port forwarding, agent forwarding, X11 forwarding, and restricting source IPs. This aligns with Annex A 5.15 because these SSH restrictions serve as concrete technical rules implementing an access control policy for logical access. Annex A 5.15 expects an organisation-wide access control framework beyond SSH and passwordless authentication scenarios.
This control partially meets A.8.9.
ISM-0487 requires specific security configurations for SSH in passwordless scenarios, including disabling forwarding and limiting access from unnecessary IPs. This maps to Annex A 8.9 because these settings form a secure configuration baseline documented, implemented, monitored, and reviewed. Annex A 8.9 applies to configuration management across different platforms, not just SSH.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.