UCF STIG Viewer Logo

The ESXi host Secure Shell (SSH) daemon must ignore ".rhosts" files.


Finding ID Version Rule ID IA Controls Severity
V-256385 ESXI-70-000012 SV-256385r919018_rule Medium
SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH can emulate the behavior of the obsolete "rsh" command in allowing users to enable insecure access to their accounts via ".rhosts" files.
VMware vSphere 7.0 ESXi Security Technical Implementation Guide 2023-06-21


Check Text ( C-60060r885934_chk )
From an ESXi shell, run the following command:

# /usr/lib/vmware/openssh/bin/sshd -T|grep ignorerhosts

Expected result:

ignorerhosts yes

If the output does not match the expected result, this is a finding.
Fix Text (F-60003r918908_fix)
From an ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":

IgnoreRhosts yes