documentation_complete: true

title: 'Enable GSSAPI Authentication'

description: |-
    Sites setup to use Kerberos or other GSSAPI Authentication require setting
    sshd to accept this authentication.
    To enable GSSAPI authentication, add or correct the following line in
    {{{ sshd_config_file() }}}
    <pre>GSSAPIAuthentication yes</pre>

rationale: |-
    Kerberos authentication for SSH is often implemented using GSSAPI. If
    Kerberos is enabled through SSH, the SSH daemon provides a means of access
    to the system's Kerberos implementation. Vulnerabilities in the system's
    Kerberos implementations may be subject to exploitation.

    For enterprises, Kerberos is often enabled and used with GSSAPI for 
    centralized user account management which may necessitate enabling of
    GSSAPI functionality in SSH. 

severity: medium

{{{ complete_ocil_entry_sshd_option(default="no", option="GSSAPIAuthentication", value="yes") }}}

template:
    name: sshd_lineinfile
    vars:
        parameter: GSSAPIAuthentication
        value: 'yes'
        datatype: string
