Detections
Analytics

5.1.11 Ensure sshd GSSAPIAuthentication is disabled

Information

The GSSAPIAuthentication parameter specifies whether user authentication based on GSSAPI is allowed

Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, and should be disabled to reduce the attack surface of the system

Solution

Edit the /etc/ssh/sshd_config file to set the GSSAPIAuthentication parameter to no above any Include and Match entries as follows:

GSSAPIAuthentication no

Note: First occurrence of an option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.

See Also

https://workbench.cisecurity.org/benchmarks/23602

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-6b., 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 7675b3fb72496a99041699ee7c0cfbb647cbd16c4e0ed8f0d9e1c85cc9a65f05