highservicesverified ✓

Ensure the SSH server service is enabled and active

ssh-service-enabled-active · UBUNTU ≥ 22 · 1 impl

Description

The ssh service must be both enabled (starts on boot) and active (currently running) so that remote access is protected by SSH.

Rationale

SSH provides the confidentiality and integrity protections required for remote administrative access. If the ssh service is not enabled and running, the system cannot offer protected remote sessions.

Check → Remediate

Checkcommand

# Ubuntu 24.04 defaults to socket activation: ssh.socket is enabled and
# ssh.service is started on demand, so 'is-enabled ssh' reports the
# socket, not the service. Accept enablement/activity via either unit.
{ systemctl is-enabled ssh.service 2>/dev/null; systemctl is-enabled ssh.socket 2>/dev/null; } | grep -qx enabled || {
  echo "FAIL: neither ssh.service nor ssh.socket is enabled"; exit 1; }
{ systemctl is-active ssh.service 2>/dev/null; systemctl is-active ssh.socket 2>/dev/null; } | grep -qx active || {
  echo "FAIL: ssh is not active (neither ssh.service nor ssh.socket)"; exit 1; }
echo "OK: ssh is enabled and active (service or socket)"; exit 0

expected_exit:: 0

Remediatemanual

note:: Enable and start the ssh service: systemctl enable --now ssh.service

Framework references

STIG

V-270666 / UBTU-24-100810V-260524 / UBTU-22-255015

NIST 800-53

AC-17(2)SC-8

Live verification

ubuntu22:checkubuntu24:check

#ssh#service#remote-access#stig