The SSH daemon must perform strict mode checking of home directory configuration files.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-39420	GEN005536-ESXI5-000110	SV-51278r1_rule		Medium

Description
If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.

STIG	Date
VMware ESXi Server 5.0 Security Technical Implementation Guide	2013-09-12

Details

Check Text ( C-46694r1_chk )
Disable lock down mode. Enable the ESXi Shell. Login as root and execute the following command(s): # grep StrictModes /etc/ssh/sshd_config If "StrictModes" is set to "no" or the keyword/line is missing, this is a finding. Re-enable lock down mode.

Fix Text (F-44433r1_fix)
Disable lock down mode. Enable the ESXi Shell. Login as root and execute the following command(s): # vi /etc/ssh/sshd_config Add/modify the "StrictModes" keyword to "yes", i.e.; StrictModes= yes Re-enable lock down mode.