On AIX, the SSH server must not permit root logins using remote access programs.

Permitting direct root login reduces auditable information about who ran privileged commands on the system and also allows direct attack attempts on root's password.

Determine if the SSH daemon is configured to disable root logins: # grep -iE "PermitRootLogin[[:blank:]]*no" /etc/ssh/sshd_config | grep -v \#

If the above command displays a line, the root login is disabled.

If the root login is not disabled, this is a finding.

Edit the "/etc/ssh/sshd_config" file to have the following line and save the change: PermitRootLogin no

Restart SSH daemon: # stopsrc -s sshd # startsrc -s sshd