Detections
Analytics

4.2.11 Ensure SSH IgnoreRhosts is enabled

Information

The IgnoreRhosts parameter specifies that .rhosts and .shosts files will not be used in RhostsRSAAuthentication or HostbasedAuthentication.

Setting this parameter forces users to enter a password when authenticating with ssh.

Solution

Edit or create a file ending in *.conf in the /etc/ssh/sshd_config.d/ directory or the /etc/ssh/sshd_config file and set the IgnoreRhosts parameter as follows:

IgnoreRhosts yes

Run the following command to comment out any IgnoreRhosts parameter entries in files ending in *.conf in the /etc/ssh/sshd_config.d/ directory or the /etc/ssh/sshd_config file that include any setting other than yes

# grep -Pi '^\h*IgnoreRhosts\b' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf | grep -Evi 'yes' | while read -r l_out; do sed -ri "/^\s*IgnoreRhosts\s+/s/^/# /" "$(awk -F: '{print $1}' <<< $l_out)";done

See Also

https://workbench.cisecurity.org/benchmarks/12705

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5

Plugin: Unix

Control ID: 9f215900480f0a444a675ea8ac0e910d64ecce5dd5c675981118bf0b543e8518