Disable SSH Support for Rhosts RSA Authentication
An XCCDF Rule
Description
SSH can allow authentication through the obsolete rsh
command through the use of the authenticating user's SSH keys. This should be disabled.
To ensure this behavior is disabled, add or correct the
following line in /etc/ssh/sshd_config:
RhostsRSAAuthentication no
warning alert: Warning
As of
openssh-server version 7.4 and above,
the RhostsRSAAuthentication option has been deprecated, and the line
RhostsRSAAuthentication noin
/etc/ssh/sshd_config is not
necessary.Rationale
Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.
- ID
- xccdf_org.ssgproject.content_rule_sshd_disable_rhosts_rsa
- Severity
- Medium
- References
- Updated