Detections
Analytics

4.2.9 Ensure sshd GSSAPIAuthentication is disabled

Information

The GSSAPIAuthentication parameter specifies whether user authentication based on GSSAPI is allowed

Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, and should be disabled to reduce the attack surface of the system

Solution

Edit the /etc/ssh/sshd_config file to set the GSSAPIAuthentication parameter to no above any Match statement:

GSSAPIAuthentication no

Note: First occurrence of a option takes precedence, Match set statements withstanding.

See Also

https://workbench.cisecurity.org/benchmarks/15965

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5

Plugin: Unix

Control ID: cc902968966b23c39fe7b8461e53c7d470e5dad5d5e66edd1c6b94acfc0b8766