STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

Red Hat Enterprise Linux CoreOS (RHCOS) must disable SSHD service.

DISA Rule

SV-257583r960963_rule

Vulnerability Number

V-257583

Group Title

SRG-APP-000141-CTR-000315

Rule Version

CNTR-OS-001010

Severity

CAT I

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.
• CCI-000877 - Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.

Weight

10

Fix Recommendation

Apply the machine config to disable SSHD service by executing following:

for mcpool in $(oc get mcp -oname | sed "s:.*/::" ); do
echo "apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
name: 80-sshd-service-disable-$mcpool
labels:
machineconfiguration.openshift.io/role: $mcpool
spec:
config:
ignition:
version: 3.1.0
systemd:
units:
- name: sshd.service
enabled: false
" | oc apply -f -
done

Check Contents

Verify the SSHD service is inactive and disabled by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; systemctl is-enabled sshd.service; systemctl is-active sshd.service' 2>/dev/null; done

If the SSHD service is either active or enabled this is a finding.

Vulnerability Number

V-257583

Documentable

False

Rule Version

CNTR-OS-001010

Severity Override Guidance

Verify the SSHD service is inactive and disabled by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; systemctl is-enabled sshd.service; systemctl is-active sshd.service' 2>/dev/null; done

If the SSHD service is either active or enabled this is a finding.

Check Content Reference

M

Target Key

5547