Detections
Analytics

1.103 SOL-11.1-040350

Information

The rhost-based authentication for SSH must be disabled.

GROUP ID: V-216353
RULE ID: SV-216353r959010

Setting this parameter forces users to enter a password when authenticating with SSH.

Solution

The root role is required.

Modify the sshd_config file

# pfedit /etc/ssh/sshd_config

Locate the line containing:

IgnoreRhosts

Change it to:

IgnoreRhosts yes

Restart the SSH service.

# svcadm restart svc:/network/ssh

This action will only set the IgnoreRhosts line if it already exists in the file to ensure that it is set to the proper value. If the IgnoreRhosts line does not exist in the file, the default setting of "Yes" is automatically used, so no additional changes are needed.

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-216353r959010_rule, STIG-ID|SOL-11.1-040350, Vuln-ID|V-216353

Plugin: Unix

Control ID: 8c1708cc576637d83be9d04307a4ffe64e65754ef7d9e53fd32f595abbaf58ba