Detections
Analytics

4.2.11 Ensure SSH IgnoreRhosts is enabled

Information

The IgnoreRhosts parameter specifies that .rhosts and .shosts files will not be used in RhostsRSAAuthentication or HostbasedAuthentication.

Setting this parameter forces users to enter a password when authenticating with SSH.

Solution

Edit the /etc/ssh/sshd_config file to set the parameter as follows:

IgnoreRhosts yes

Note: First occurrence of a option takes precedence, Match set statements withstanding.

See Also

https://workbench.cisecurity.org/benchmarks/13007

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 134bc42b1cfd87cb792215a1799e481d6b92068fb0ac115b794cab2f39b3071b