Detections
Analytics

4.6.3.8 Ensure sshd IgnoreRhosts is enabled

Information

The IgnoreRhosts parameter specifies that .rhosts and .shosts files will not be used in RhostsRSAAuthentication or HostbasedAuthentication.

Setting this parameter forces users to enter a password or provide an SSH key when authenticating with SSH, rather than trusting the remote host.

Solution

Edit the /etc/ssh/sshd_config file to set the parameter above any Match set entries as follows:

IgnoreRhosts yes

Re-cycle the sshd daemon to pick up the configuration changes:

stopsrc -s sshd
startsrc -s sshd

Note: First occurrence of a option takes precedence, Match set statements withstanding.

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-6, 800-53|CM-7, 800-53|MA-4, CSCv7|9.2

Plugin: Unix

Control ID: dff42905b0ada6e8b14ee95c75eb8539012169376dd541f87d8b359e4f90772e