Configuring SSH - disallow host based authentication

높음레벨 1수동 검토ibm-i

설명

The recommendation is to edit the /QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config file to ensure that host- based authentication is disallowed. Using host-based authentication, any user on a trusted host can log into another host on which this feature is enabled. Since this feature depends only on system authentication and not on user authentication, it must be disabled.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

DSPF '/QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config' On the Control field, type HostbasedAuthentication and press F16 (shift F4) Control: HostbasedAuthentication___________________________________ The display should yield the following output: HostbasedAuthentication no

조치 방법

조치 방식: 가이드 또는 인프라 패치

EDTF '/QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config' file to ensure that host based authentication is disallowed: Replace: #HostbasedAuthentication no With: HostbasedAuthentication no Re-cycle the sshd daemon to pick up the configuration changes:

속성

운영 체제: 모두
태그: ibm-issh
참고 자료: CIS IBM i V7R5M0 Benchmark v2.1.0 - 5.4.3 Configuring SSH - disallow host based authentication