Detections
Analytics

5.1.14 Ensure sshd IgnoreRhosts is enabled

Information

The IgnoreRhosts parameter specifies that .rhosts and .shosts files will not be used in RhostsRSAAuthentication or HostbasedAuthentication.

Setting this parameter forces users to enter a password when authenticating with SSH.

Solution

Edit the /etc/ssh/sshd_config file to set the IgnoreRhosts parameter to yes above any Include entry as follows:

IgnoreRhosts yes

Impact:

Enabling IgnoreRhosts prevents .rhosts and .shosts files from being used during authentication. Any workflow that relies on rhosts-style host-based trust will stop working and must be migrated to key-based authentication before this recommendation is applied.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: fb5426b00c5821c685e5b224cd62d73a675bd48a5a55bd05d843244af2a7d7c2