The ESXi host Secure Shell (SSH) daemon must not allow host-based authentication.

An XCCDF Rule

Description

SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH's cryptographic host-based authentication is more secure than ".rhosts" authentication since hosts are cryptographically authenticated. However, it is not recommended that hosts unilaterally trust one another, even within an organization.

ID: SV-258761r959010_rule
Version: ESXI-80-000202
Severity: Medium
References: CCI-000366
Updated: about 2 months ago

Remediation Templates

From an ESXi shell, run the following command:

# esxcli system ssh server config set -k hostbasedauthentication -v no

or
From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.ssh.server.config.set.CreateArgs()
$arguments.keyword = 'hostbasedauthentication'
$arguments.value = 'no'
$esxcli.system.ssh.server.config.set.Invoke($arguments)

The ESXi host Secure Shell (SSH) daemon must not allow host-based authentication.

Description

Remediation Templates

A Manual Procedure