How do I install the CIS Ubuntu 14.04 LTS - 5.2.14 Ensure SSH access is limited skill?

Run npx skillmds@latest add cyberstrikeus/cis-ubuntu-14-04-lts-5-2-14-ensure-ssh-access-is-limited in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is CIS Ubuntu 14.04 LTS - 5.2.14 Ensure SSH access is limited safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with CIS Ubuntu 14.04 LTS - 5.2.14 Ensure SSH access is limited?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is CIS Ubuntu 14.04 LTS - 5.2.14 Ensure SSH access is limited free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published CIS Ubuntu 14.04 LTS - 5.2.14 Ensure SSH access is limited?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

CIS Ubuntu 14.04 LTS - 5.2.14 Ensure SSH access is limited by cyberstrikeus

Name: CIS Ubuntu 14.04 LTS - 5.2.14 Ensure SSH access is limited
Author: cyberstrikeus

File contents

5.2.14 Ensure SSH access is limited (Scored)

Profile Applicability

Level 1 - Server
Level 1 - Workstation

Description

There are several options available to limit which users and group can access the system via SSH. It is recommended that at least one of the following options be leveraged:

AllowUsers - gives the system administrator the option of allowing specific users to ssh into the system. The list consists of comma separated user names.
AllowGroups - gives the system administrator the option of allowing specific groups of users to ssh into the system. The list consists of comma separated group names.
DenyUsers - gives the system administrator the option of denying specific users to ssh into the system. The list consists of comma separated user names.
DenyGroups - gives the system administrator the option of denying specific groups of users to ssh into the system. The list consists of comma separated group names.

Rationale

Restricting which users can remotely access the system via SSH will help ensure that only authorized users access the system.

Audit Procedure

Run the following commands and verify that output matches for at least one:

grep "^AllowUsers" /etc/ssh/sshd_config
grep "^AllowGroups" /etc/ssh/sshd_config
grep "^DenyUsers" /etc/ssh/sshd_config
grep "^DenyGroups" /etc/ssh/sshd_config

Expected Result

At least one of the following should be configured:

AllowUsers <userlist>
AllowGroups <grouplist>
DenyUsers <userlist>
DenyGroups <grouplist>

Remediation

Edit the /etc/ssh/sshd_config file to set one or more of the parameter as follows:

AllowUsers <userlist>
AllowGroups <grouplist>
DenyUsers <userlist>
DenyGroups <grouplist>

Default Value

No restrictions by default.

References

CIS Controls: 5.1 - Minimize And Sparingly Use Administrative Privileges
CIS Controls: 5.8 - Administrators Should Not Directly Log In To A System (i.e. use RunAs/sudo)

Profile

Level 1 - Server
Level 1 - Workstation

---name: cis-ubuntu-14-04-lts-5-2-14-ensure-ssh-access-is-limiteddescription: Verify SSH access is limited using AllowUsers, AllowGroups, DenyUsers, or DenyGroups directives---# 5.2.14 Ensure SSH access is limited (Scored)## Profile Applicability- Level 1 - Server- Level 1 - Workstation## DescriptionThere are several options available to limit which users and group can access the system via SSH. It is recommended that at least one of the following options be leveraged:- `AllowUsers` - gives the system administrator the option of allowing specific users to `ssh` into the system. The list consists of comma separated user names.- `AllowGroups` - gives the system administrator the option of allowing specific groups of users to `ssh` into the system. The list consists of comma separated group names.- `DenyUsers` - gives the system administrator the option of denying specific users to `ssh` into the system. The list consists of comma separated user names.- `DenyGroups` - gives the system administrator the option of denying specific groups of users to `ssh` into the system. The list consists of comma separated group names.## RationaleRestricting which users can remotely access the system via SSH will help ensure that only authorized users access the system.## Audit ProcedureRun the following commands and verify that output matches for at least one:```bashgrep "^AllowUsers" /etc/ssh/sshd_configgrep "^AllowGroups" /etc/ssh/sshd_configgrep "^DenyUsers" /etc/ssh/sshd_configgrep "^DenyGroups" /etc/ssh/sshd_config```## Expected ResultAt least one of the following should be configured:```AllowUsers <userlist>AllowGroups <grouplist>DenyUsers <userlist>DenyGroups <grouplist>```## RemediationEdit the `/etc/ssh/sshd_config` file to set one or more of the parameter as follows:```AllowUsers <userlist>AllowGroups <grouplist>DenyUsers <userlist>DenyGroups <grouplist>```## Default ValueNo restrictions by default.## References- CIS Controls: 5.1 - Minimize And Sparingly Use Administrative Privileges- CIS Controls: 5.8 - Administrators Should Not Directly Log In To A System (i.e. use RunAs/sudo)## Profile- Level 1 - Server- Level 1 - Workstation

Frequently asked questions

CIS Ubuntu 14.04 LTS - 5.2.14 Ensure SSH access is limited