Detections
Analytics

6.5.4 Host SSH daemon, if enabled, must not allow host-based authentication

Information

Ensuring the SSH daemon on the host disallows host-based authentication is a crucial step towards hardening system services. This prevents a host from authenticating on behalf of the users, thereby enforcing individual accountability and minimizing the risk of unauthorized access.

Disallowing host-based authentication enforces a more secure user authentication mechanism, promoting individual accountability. It minimizes the risk associated with trust relationships among hosts, thereby enhancing the overall security of the system.

Solution

To remediate this recommendation, set HostbasedAuthentication no, restart SSH if it is authorized to run, and verify host-based authentication is rejected.

Impact:

No functional impact is associated with this control. It solely acts to enhance security by enforcing stricter authentication practices, without hindering system operations.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|5.1

Plugin: Unix

Control ID: 18cc636672bf5fdc32e4f23995d463aa38273fb268a56851ebc824cb1f7cdd9c