Description of problem:

Hi,
The rule "xccdf_org.ssgproject.content_rule_sshd_limit_user_access" has an incorrect description.See:

By default, the SSH configuration allows any user with an account to access the system. In order to specify the users that are allowed to login via SSH and deny all other users, add or correct the following line in the /etc/ssh/sshd_config file: DenyUsers USER1 USER2 Where USER1 and USER2 are valid user names.




Version-Release number of selected component (if applicable):
scap-security-guide.noarch                                                                0.1.50-7.el8

How reproducible:
Read the rule description

Steps to Reproduce:
1.
2.
3.

Actual results:
In order to specify the users that are allowed to login via SSH and deny all other users, add or correct the following line in the /etc/ssh/sshd_config file: DenyUsers USER1 USER2 Where USER1 and USER2 are valid user names.


Expected results:
If we use DenyUsers, then it should be rephrase like this:

In order to specify the users that are denied to login via SSH and allow all other users, add or correct the following line in the /etc/ssh/sshd_config file: DenyUsers USER1 USER2 Where USER1 and USER2 are valid user names.

Additional info:

The above is based on the fact that the example talks about DenyUsers. The method could talk about DenyGroups or AllowUsers for example.

Extract from the manpage:
https://www.freebsd.org/cgi/man.cgi?query=sshd_config&sektion=5

  DenyUsers
	     This keyword can be followed by a list of user name patterns,
	     separated by spaces.  Login is disallowed for user	names that
	     match one of the patterns.	 Only user names are valid; a numeri-
	     cal user ID is not	recognized.  By	default, login is allowed for
	     all users.	 If the	pattern	takes the form USER@HOST then USER and
	     HOST are separately checked, restricting logins to	particular
	     users from	particular hosts.  HOST	criteria may additionally con-
	     tain addresses to match in	CIDR address/masklen format.  The al-
	     low/deny directives are processed in the following	order:
	     DenyUsers,	AllowUsers, DenyGroups,	and finally AllowGroups.