documentation_complete: true

title: 'Disable SSH Support for Rhosts RSA Authentication'

description: |-
    SSH can allow authentication through the obsolete rsh
    command through the use of the authenticating user's SSH keys. This should be disabled.
    <br /><br />
    To ensure this behavior is disabled, add or correct the
    following line in <tt>/etc/ssh/sshd_config</tt>:
    <pre>RhostsRSAAuthentication no</pre>

rationale: |-
    Configuring this setting for the SSH daemon provides additional
    assurance that remote login via SSH will require a password, even
    in the event of misconfiguration elsewhere.

severity: medium

identifiers:
    cce@rhel8: CCE-80900-4
    cce@rhel9: CCE-87836-3
    cce@rhel10: CCE-89866-8

references:
    cis-csc: 11,3,9
    cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05
    cui: 3.1.12
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
    isa-62443-2009: 4.3.4.3.2,4.3.4.3.3
    isa-62443-2013: 'SR 7.6'
    iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4
    nist: AC-17(a),CM-7(a),CM-7(b),CM-6(a)
    nist-csf: PR.IP-1
    srg: SRG-OS-000480-GPOS-00227
    stigid@ol7: OL07-00-040330

ocil: |
    To check which SSH protocol version is allowed, check version of
    <tt>openssh-server</tt> with following command:
    <pre>$ rpm -qi openssh-server | grep Version</pre>
    Versions equal to or higher than 7.4 have deprecated the <tt>RhostsRSAAuthentication</tt> option.
    If version is lower than 7.4, run the following command to check configuration:
    {{{ ocil_sshd_option(default="no", option="RhostsRSAAuthentication", value="no") }}}

{{{ ocil_clause_entry_sshd_option() }}}

warnings:
    - general: |-
        As of <tt>openssh-server</tt> version <tt>7.4</tt> and above,
        the <tt>RhostsRSAAuthentication</tt> option has been deprecated, and the line
        <pre>RhostsRSAAuthentication no</pre> in <tt>/etc/ssh/sshd_config</tt> is not
        necessary.

template:
    name: sshd_lineinfile
    vars:
        parameter: RhostsRSAAuthentication
        value: "no"
        datatype: string

