cyberstrikeus 9.3.7 Set SSH HostbasedAuthentication to No (Scored)
Profile Applicability
- Level 1
Description
The HostbasedAuthentication parameter specifies if authentication is allowed through trusted hosts via the user of .rhosts, or /etc/hosts.equiv, along with successful public key client host authentication. This option only applies to SSH Protocol Version 2.
Rationale
Even though the .rhosts files are ineffective if support is disabled in /etc/pam.conf, disabling the ability to use .rhosts files in SSH provides an additional layer of protection.
Audit Procedure
Using Command Line
To verify the correct SSH setting, run the following command and verify that the output is as shown:
grep "^HostbasedAuthentication" /etc/ssh/sshd_config
Expected Result
HostbasedAuthentication no
Remediation
Using Command Line
Edit the /etc/ssh/sshd_config file to set the parameter as follows:
HostbasedAuthentication no
Default Value
HostbasedAuthentication no
References
- CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0
Profile
Level 1 - Scored