STIGQter: STIG Summary: Red Hat Enterprise Linux 7 Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 23 Apr 2021:

The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.

DISA Rule

SV-204598r603261_rule

Vulnerability Number

V-204598

Group Title

SRG-OS-000364-GPOS-00151

Rule Version

RHEL-07-040430

Severity

CAT II

CCI(s)

• CCI-000318 - The organization audits and reviews activities associated with configuration-controlled changes to the system.
• CCI-001812 - The information system prohibits user installation of software without explicit privileged status.
• CCI-001813 - The information system enforces access restrictions.
• CCI-000368 - The organization documents any deviations from the established configuration settings for organization-defined information system components based on organization-defined operational requirements.
• CCI-001814 - The Information system supports auditing of the enforcement actions.

Weight

10

Fix Recommendation

Uncomment the "GSSAPIAuthentication" keyword in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to "no":

GSSAPIAuthentication no

The SSH service must be restarted for changes to take effect.

If GSSAPI authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.

Check Contents

Verify the SSH daemon does not permit GSSAPI authentication unless approved.

Check that the SSH daemon does not permit GSSAPI authentication with the following command:

# grep -i gssapiauth /etc/ssh/sshd_config
GSSAPIAuthentication no

If the "GSSAPIAuthentication" keyword is missing, is set to "yes" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.

Vulnerability Number

V-204598

Documentable

False

Rule Version

RHEL-07-040430

Severity Override Guidance

Verify the SSH daemon does not permit GSSAPI authentication unless approved.

Check that the SSH daemon does not permit GSSAPI authentication with the following command:

# grep -i gssapiauth /etc/ssh/sshd_config
GSSAPIAuthentication no

If the "GSSAPIAuthentication" keyword is missing, is set to "yes" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.

Check Content Reference

M

Target Key

2899

Comments