Detections
Analytics

4.6.3.7 Ensure sshd HostbasedAuthentication is disabled

Information

The HostbasedAuthentication parameter specifies if authentication is allowed through trusted hosts via the user of .rhosts, or /etc/hosts.equiv, along with successful public key client host authentication.

Host-based authentication is a method to authenticate users (rather than requiring password or key-based authentication method).
Used at a system level by OpenSSH requires the file /etc/shosts.equiv to contain a list of so-called trusted hosts.
When this method is active any user on a trusted host can login to the server as authenticated because the server identity the user imitates the connection from (aka the OpenSSH client) authentificatees the user as trusted.

Since this feature disables user-based authentication from some hosts - our recommendation is to disable host-based authentication.

Solution

Edit the /etc/ssh/sshd_config file to set the parameter above any Match entries as follows:

HostbasedAuthentication no

Re-cycle the sshd daemon to pick up the configuration changes:

stopsrc -s sshd
startsrc -s sshd

Note: First occurrence of a option takes precedence, Match set statements withstanding.

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-6, 800-53|CM-7, 800-53|MA-4, CSCv7|9.2

Plugin: Unix

Control ID: 6d60dfa3dfc59af1bb094b1d7ab9e6e1ebc113a2bd6d8c5bc7dd91b904ba42fa