I am a DevOps engineer working with AWS. My company is under a security audit and we got a report stating the following points:
--- REPORT BEGIN ---
Observation: In some EC2 instances, anonymous logins are allowed which in turn allows users with root privileges to login without a password.
Consequences: It can grant non-authorized access to the console which might cause privilege scalation or issues with data confidentiality.
Recommendation: To always ask password when logging in and also when executing root commands.
Action: Implement
.pem
certificates and disable anonymous login for the given ec2 list.--- REPORT END ---
All instances listed in their report have already these mitigations in place:
- To SSH to them you need a
.pem
file - You cannot SSH to them with the root user (you must login with another user e.g. centos, ubuntu)
- Once you are connected to an instance with a user that can executes root commands, if you try to execute a root command you have to type the user's password.
- There were around 27 instances reported. Almost all of them have Ubuntu or CentOS.
So having said that, my questions are...
- What am I missing to meet the audit requirements?
- What would they mean by anonymous login?
- How to disable whatever this "anonymous login" is?
My only idea as of now is to ask for both KeyAuthentication
and PasswordAuthentication
when SSH, but not sure if that would help or hurt.