Detections
Analytics
UBTU-16-030300 - The SSH daemon must not allow authentication using known hosts authentication.
Information
Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.Solution
Configure the SSH daemon to not allow authentication using known hosts authentication.Add the following line in '/etc/ssh/sshd_config', or uncomment the line and set the value to 'yes':
IgnoreUserKnownHosts yes
The SSH daemon must be restarted for the changes to take effect. To restart the SSH daemon, run the following command:
# sudo systemctl restart sshd.service
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CAN_Ubuntu_16-04_LTS_V2R3_STIG.zip
Item Details
Audit Name: DISA STIG Ubuntu 16.04 LTS v2r3
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-215131r610931_rule, STIG-ID|UBTU-16-030300, STIG-Legacy|SV-90521, STIG-Legacy|V-75841, Vuln-ID|V-215131
Plugin: Unix
Control ID: 61607199488e047e1749aa86ad80b94d180a41698351c95a2306dff7049a844b