Detections
Analytics

1.261 ALMA-09-033240

Information

AlmaLinux OS 9 SSHD must accept public key authentication.

GROUP ID: V-269367
RULE ID: SV-269367r1050250

Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased.

Multifactor authentication requires using two or more factors to achieve authentication.

Factors include:

 - something a user knows (e.g., password/PIN);
 - something a user has (e.g., cryptographic identification device, token); and
 - something a user is (e.g., biometric).

A privileged account is defined as an information system account with authorizations of a privileged user.

Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet).

The DOD CAC with DOD-approved PKI is an example of multifactor authentication.

Solution

Configure the SSH daemon to accept public key encryption.

Add the following line to "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes":

PubkeyAuthentication yes

Alternatively, add the setting to an include file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file:

$ cat << EOF | tee /etc/ssh/sshd_config.d/pubkey.conf

PubkeyAuthentication yes
EOF

Restart the SSH daemon for the settings to take effect:

$ systemctl restart sshd.service

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(1), CCI|CCI-000765, Rule-ID|SV-269367r1050250_rule, STIG-ID|ALMA-09-033240, Vuln-ID|V-269367

Plugin: Unix

Control ID: 4074c89522d07ef3be6f3eb8ccebb8d2511fdfaf974b9367261984f07d1d81cd