Detections
Analytics
WN25-SH-000110 - Windows Server 2025 OpenSSH must not allow GSSAPI authentication.
Information
Generic Security Service Application Program Interface (GSSAPI) authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system.Satisfies: SRG-OS-000364-GPOS-00151, SRG-OS-000480-GPOS-00228
Solution
To configure the system, add or modify the following line in the '$env:ProgramData/ssh/sshd_config' file:GSSAPIAuthentication no
Restart the OpenSSH service for the settings to take effect.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2025_V1R3_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows Server 2025 STIG v1r3
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-5(1), CAT|II, CCI|CCI-001813, Rule-ID|SV-285323r1211197_rule, STIG-ID|WN25-SH-000110, Vuln-ID|V-285323
Plugin: Windows
Control ID: da9cb5f9e084e44aef934f42ace221e35c5053981d3e225e6ba9a84c926f31ad