STIGQter: STIG Summary: Red Hat Enterprise Linux 7 Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 23 Apr 2021:

The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed.

DISA Rule

SV-204599r603261_rule

Vulnerability Number

V-204599

Group Title

SRG-OS-000364-GPOS-00151

Rule Version

RHEL-07-040440

Severity

CAT II

CCI(s)

• CCI-000368 - The organization documents any deviations from the established configuration settings for organization-defined information system components based on organization-defined operational requirements.
• CCI-001813 - The information system enforces access restrictions.
• CCI-001812 - The information system prohibits user installation of software without explicit privileged status.
• CCI-001814 - The Information system supports auditing of the enforcement actions.
• CCI-000318 - The organization audits and reviews activities associated with configuration-controlled changes to the system.

Weight

10

Fix Recommendation

Uncomment the "KerberosAuthentication" keyword in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to "no":

KerberosAuthentication no

The SSH service must be restarted for changes to take effect.

If Kerberos authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.

Check Contents

Verify the SSH daemon does not permit Kerberos to authenticate passwords unless approved.

Check that the SSH daemon does not permit Kerberos to authenticate passwords with the following command:

# grep -i kerberosauth /etc/ssh/sshd_config
KerberosAuthentication no

If the "KerberosAuthentication" keyword is missing, or is set to "yes" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.

Vulnerability Number

V-204599

Documentable

False

Rule Version

RHEL-07-040440

Severity Override Guidance

Verify the SSH daemon does not permit Kerberos to authenticate passwords unless approved.

Check that the SSH daemon does not permit Kerberos to authenticate passwords with the following command:

# grep -i kerberosauth /etc/ssh/sshd_config
KerberosAuthentication no

If the "KerberosAuthentication" keyword is missing, or is set to "yes" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.

Check Content Reference

M

Target Key

2899

Comments