TMA-COS-5.1.8

Ensure SSH IgnoreRhosts is enabled

MediumLevel 1Automatedcos

Description

The IgnoreRhosts parameter specifies that .rhosts and .shosts files will not be used in RhostsRSAAuthentication or HostbasedAuthentication. Setting this parameter forces users to enter a password when authenticating with ssh.

How it is checked

Audit method: Shell command

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v sshd >/dev/null 2>&1 || { echo "step1: sshd not installed"; return 1; }; o=$(bash -c 'sshd -T | grep ignorerhosts' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'IgnoreRhosts yes' || { echo step1: missing 'IgnoreRhosts yes'; return 1; }; }; if alt0; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Edit the /etc/ssh/sshd_config file to set the parameter as follows: IgnoreRhosts yes

Properties

Operating systems: Any
Tags: container-optimized-oscosssh
Reference: CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.1.8 Ensure SSH IgnoreRhosts is enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target cos