Detections
Analytics

5.1.12 Ensure sshd IgnoreRhosts is enabled

Information

The IgnoreRhosts parameter specifies that .rhosts and .shosts files will not be used in RhostsRSAAuthentication or HostbasedAuthentication.

More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

Setting this parameter forces users to enter a password when authenticating with SSH.

Solution

Create or edit a *.conf file in the /etc/ssh/sshd_config.d/ and set the IgnoreRhosts parameter to yes above any Include entry as follows:

IgnoreRhosts yes

Run the following command to apply the configuration change to the running sshd daemon without interrupting active sessions:

# systemctl reload sshd

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 0b21c0c6909a60f919294021a7c5c62a658aab86e66f7dcf1469a8585846fc56