Disable Host-based Authentication for Login-based Services

HighLevel 1Automatedsolaris

Description

The .rhosts files are used for automatic login to remote hosts and contain username and hostname combinations. The .rhosts files are unencrypted (usually group- or world-readable) and present a serious risk in that a malicious user could use the information within to gain access to a remote host with the privileges of the original application or user. Audit: no uncommented pam_rhosts_auth entry may exist in /etc/pam.conf or /etc/pam.d/*.

How it is checked

Audit method: Shell command

shell

command -v grep >/dev/null 2>&1 || exit 1; out=$( { grep -h pam_rhosts_auth /etc/pam.conf /etc/pam.d/* | grep -v "^[[:blank:]]*#" ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Edit /etc/pam.conf and any /etc/pam.d/* results from audit procedure and comment out or remove any pam_rhosts_auth lines: #rlogin auth sufficient pam_rhosts_auth.so.1 #rsh auth sufficient pam_rhosts_auth.so.1

Properties

Operating systems: Any
Tags: solarisaccounts
Reference: CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 6.10 Disable Host-based Authentication for Login-based Services

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target solaris