documentation_complete: true

title: 'Disable GSSAPI Authentication'

description: |-
    Unless needed, SSH should not permit extraneous or unnecessary
    authentication mechanisms like GSSAPI. To disable GSSAPI authentication, add or
    correct the following line in the <tt>/etc/ssh/sshd_config</tt> file:
    <pre>GSSAPIAuthentication no</pre>

rationale: |-
    GSSAPI authentication is used to provide additional authentication mechanisms to
    applications. Allowing GSSAPI authentication through SSH exposes the system's
    GSSAPI to remote hosts, increasing the attack surface of the system.

severity: medium

identifiers:
    cce@rhel7: 80220-7

references:
    cui: 3.1.12
    disa: 368,318,1812,1813,1814
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
    nist: CM-6(c)
    ospp@rhel7: FIA_AFL.1
    srg: SRG-OS-000364-GPOS-00151
    stigid@rhel7: "040430"

ocil_clause: 'it is commented out or is not disabled'

ocil: |-
    To check if GSSAPIAuthentication is disabled or set correctly, run the following
    command:
    <pre>$ sudo grep GSSAPIAuthentication /etc/ssh/sshd_config</pre>
    If configured properly, output should be <pre>no</pre>
