RHEL 9 SSH daemon must not allow GSSAPI authentication.
An XCCDF Rule
Description
<VulnDiscussion>Generic Security Service Application Program Interface (GSSAPI) authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system. Satisfies: SRG-OS-000364-GPOS-00151, SRG-OS-000480-GPOS-00227</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-258003r925996_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Configure the SSH daemon to not allow GSSAPI authentication.
Add the following line in "/etc/ssh/sshd_config", or uncomment the line and set the value to "no":
GSSAPIAuthentication no