documentation_complete: true

title: 'Disable GSSAPI Authentication'

description: |-
    Unless needed, SSH should not permit extraneous or unnecessary
    authentication mechanisms like GSSAPI.
    <br/>
    The default SSH configuration disallows authentications based on GSSAPI. The appropriate
    configuration is used if no value is set for <tt>GSSAPIAuthentication</tt>.
    <br/>
    To explicitly disable GSSAPI authentication, add or correct the following line in
    {{{ sshd_config_file() }}}
    <pre>GSSAPIAuthentication no</pre>

rationale: |-
    GSSAPI authentication is used to provide additional authentication mechanisms to
    applications. Allowing GSSAPI authentication through SSH exposes the system's
    GSSAPI to remote hosts, increasing the attack surface of the system.

severity: medium

identifiers:
    cce@rhel8: CCE-80897-2
    cce@rhel9: CCE-90808-7
    cce@rhel10: CCE-89145-7
    cce@sle15: CCE-91441-6
    cce@sle16: CCE-96581-4

references:
    cis-csc: 11,3,9
    cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05
    cui: 3.1.12
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
    isa-62443-2009: 4.3.4.3.2,4.3.4.3.3
    isa-62443-2013: 'SR 7.6'
    iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4
    nist: CM-7(a),CM-7(b),CM-6(a),AC-17(a)
    nist-csf: PR.IP-1
    ospp: FTP_ITC_EXT.1,FCS_SSH_EXT.1.2
    srg: SRG-OS-000364-GPOS-00151,SRG-OS-000480-GPOS-00227
    stigid@ol7: OL07-00-040430
    stigid@ol8: OL08-00-010522

{{{ complete_ocil_entry_sshd_option(default="yes", option="GSSAPIAuthentication", value="no") }}}

fixtext: |-
    {{{ fixtext_sshd_lineinfile("GSSAPIAuthentication", "no") }}}

srg_requirement: 'The {{{ full_name }}} SSH daemon must not allow GSSAPI authentication, except to fulfill documented and validated mission requirements.'

template:
    name: sshd_lineinfile
    vars:
        parameter: GSSAPIAuthentication
        value: 'no'
        datatype: string
        is_default_value: 'true'
