STIGQter: STIG Summary: SUSE Linux Enterprise Server 15 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 23 Apr 2021:

The SUSE operating system SSH daemon must be configured to not allow authentication using known hosts authentication.

DISA Rule

SV-235007r622137_rule

Vulnerability Number

V-235007

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

SLES-15-040230

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Configure the SUSE operating system SSH daemon to not allow authentication using "known hosts" authentication.

Add the following line in "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes":

IgnoreUserKnownHosts yes

Check Contents

Verify the SUSE operating system SSH daemon is configured to not allow authentication using "known hosts" authentication.

To determine how the SSH daemon's "IgnoreUserKnownHosts" option is set, run the following command:

> sudo grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config

IgnoreUserKnownHosts yes

If the value is returned as "no", the returned line is commented out, or no output is returned, this is a finding.

Vulnerability Number

V-235007

Documentable

False

Rule Version

SLES-15-040230

Severity Override Guidance

Verify the SUSE operating system SSH daemon is configured to not allow authentication using "known hosts" authentication.

To determine how the SSH daemon's "IgnoreUserKnownHosts" option is set, run the following command:

> sudo grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config

IgnoreUserKnownHosts yes

If the value is returned as "no", the returned line is commented out, or no output is returned, this is a finding.

Check Content Reference

M

Target Key

5274

Comments