STIGQter: STIG Summary: Amazon Linux 2023 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Jul 2026:

Amazon Linux 2023 SSH daemon must not allow Generic Security Service Application Program Interface (GSSAPI) authentication.

DISA Rule

SV-274044r1120120_rule

Vulnerability Number

V-274044

Group Title

SRG-OS-000364-GPOS-00151

Rule Version

AZLX-23-001215

Severity

CAT II

CCI(s)

CCI-001813 - Enforce access restrictions using organization-defined mechanisms.

Weight

Fix Recommendation

Configure Amazon Linux 2023 so that the SSH daemon does not allow GSSAPI authentication.

Add or uncomment the following line to "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d" and set the value to "no":

GSSAPIAuthentication no

The SSH service must be restarted for changes to take effect:

$ sudo systemctl restart sshd.service

Check Contents

Verify Amazon Linux 2023 is configured so that the SSH daemon does not allow GSSAPI authentication with the following command:

$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*gssapiauthentication'
/etc/ssh/sshd_config.d/50-redhat.conf:GSSAPIAuthentication no

If the value is returned as "yes", the returned line is commented out, no output is returned, and the use of GSSAPI authentication has not been documented with the information system security officer (ISSO), this is a finding.

If the required value is not set, this is a finding.

Vulnerability Number

V-274044

Documentable

False

Rule Version

AZLX-23-001215

Severity Override Guidance

Check Content Reference

Target Key

5700