STIGQter: STIG Summary: SLES 12 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The SUSE operating system SSH daemon must be configured to not allow authentication using known hosts authentication.

DISA Rule

SV-217274r603262_rule

Vulnerability Number

V-217274

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

SLES-12-030200

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Configure the SUSE operating system SSH daemon to not allow authentication using known hosts authentication.

Add the following line in "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes":

IgnoreUserKnownHosts yes

Check Contents

Verify the SUSE operating system SSH daemon is configured to not allow authentication using known hosts authentication.

To determine how the SSH daemon's "IgnoreUserKnownHosts" option is set, run the following command:

# sudo grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config

IgnoreUserKnownHosts yes

If the value is returned as "no", the returned line is commented out, or no output is returned, this is a finding.

Vulnerability Number

V-217274

Documentable

False

Rule Version

SLES-12-030200

Severity Override Guidance

Verify the SUSE operating system SSH daemon is configured to not allow authentication using known hosts authentication.

To determine how the SSH daemon's "IgnoreUserKnownHosts" option is set, run the following command:

# sudo grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config

IgnoreUserKnownHosts yes

If the value is returned as "no", the returned line is commented out, or no output is returned, this is a finding.

Check Content Reference

M

Target Key

4033

Comments