UCF STIG Viewer Logo

The SSH daemon must not allow authentication using RSA rhosts authentication.


Overview

Finding ID Version Rule ID IA Controls Severity
V-72239 RHEL-07-040330 SV-86863r3_rule Medium
Description
Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.
STIG Date
Red Hat Enterprise Linux 7 Security Technical Implementation Guide 2017-12-14

Details

Check Text ( C-72473r4_chk )
Verify the SSH daemon does not allow authentication using RSA rhosts authentication.

To determine how the SSH daemon's "RhostsRSAAuthentication" option is set, run the following command:

# grep RhostsRSAAuthentication /etc/ssh/sshd_config
RhostsRSAAuthentication no

If the value is returned as "yes", the returned line is commented out, or no output is returned, this is a finding.
Fix Text (F-78593r4_fix)
Configure the SSH daemon to not allow authentication using RSA rhosts authentication.

Add the following line in "/etc/ssh/sshd_config", or uncomment the line and set the value to "no":

RhostsRSAAuthentication no

The SSH service must be restarted for changes to take effect.