Detections
Analytics

4.2.8 Ensure SSH HostbasedAuthentication is disabled

Information

The HostbasedAuthentication parameter specifies if authentication is allowed through trusted hosts via the user of .rhosts, or /etc/hosts.equiv, along with successful public key client host authentication. This option only applies to SSH Protocol Version 2.

Even though the .rhosts files are ineffective if support is disabled in /etc/pam.conf, disabling the ability to use .rhosts files in SSH provides an additional layer of protection.

Solution

Edit or create a file ending in *.conf in the /etc/ssh/sshd_config.d/ directory or the /etc/ssh/sshd_config file and set the HostbasedAuthentication parameter as follows:

HostbasedAuthentication no

Run the following command to comment out any HostbasedAuthentication parameter entries in files ending in *.conf in the /etc/ssh/sshd_config.d/ directory or the /etc/ssh/sshd_config file that include any setting other than no :

# grep -Pi '^\h*HostbasedAuthentication\b' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf | grep -Evi 'no' | while read -r l_out; do sed -ri "/^\s*HostbasedAuthentication\s+/s/^/# /" "$(awk -F: '{print $1}' <<< $l_out)";done

See Also

https://workbench.cisecurity.org/benchmarks/12705

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND SERVICES ACQUISITION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|IA-5, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|16.3

Plugin: Unix

Control ID: 99a78d0e4c84636b86d24e50ead78dd5f7283cc71d2c7080ff15561926c9edd6