If GSSAPI authentication is not required on AIX, the SSH daemon must disable GSSAPI authentication.
An XCCDF Rule
Description
<VulnDiscussion>GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-215292r1009548_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Edit "/etc/ssh/sshd_config" and remove the "GSSAPIAuthentication" setting or change the value to "no".
Refresh sshd:
# stopsrc -s sshd
# startsrc -s sshd