Detections
Analytics

5.1.11 Ensure sshd HostbasedAuthentication is disabled

Information

The HostbasedAuthentication parameter specifies if authentication is allowed through trusted hosts via the user of .rhosts, or /etc/hosts.equiv, along with successful public key client host authentication.

More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

Even though the .rhosts files are ineffective if support is disabled in /etc/pam.conf, disabling the ability to use .rhosts files in SSH provides an additional layer of protection.

Solution

Create or edit a *.conf file in the /etc/ssh/sshd_config.d/ and set the HostbasedAuthentication parameter to no above any Include and Match entries as follows:

HostbasedAuthentication no

Run the following command to apply the configuration change to the running sshd daemon without interrupting active sessions:

# systemctl reload sshd

See Also

https://workbench.cisecurity.org/benchmarks/27798

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 29db5b204b9082cbe9fab6e3d66e2196c8a02ba1a752ec1929c6239e5e8d0232