documentation_complete: true

title: 'Disable SSH Support for Rhosts RSA Authentication'

description: |-
    SSH can allow authentication through the obsolete rsh
    command through the use of the authenticating user's SSH keys. This should be disabled.
    <br /><br />
    To ensure this behavior is disabled, add or correct the
    following line in <tt>/etc/ssh/sshd_config</tt>:
    <pre>RhostsRSAAuthentication no</pre>

rationale: |-
    Configuring this setting for the SSH daemon provides additional
    assurance that remove login via SSH will require a password, even
    in the event of misconfiguration elsewhere.

severity: medium

identifiers:
    cce@rhel7: 80373-4

references:
    cui: 3.1.12
    disa: 366
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
    nist: CM-6(a)
    ospp@rhel7: FIA_AFL.1
    srg: SRG-OS-000480-GPOS-00227
    stigid@rhel7: "040330"

ocil: |-
    To check which SSH protocol version is allowed, check version of
    <tt>openssh-server</tt> with following command:
    <pre>$ rpm -qi openssh-server | grep Version</pre>
    Versions equal to or higher than 7.4 have deprecated the <tt>RhostsRSAAuthentication</tt> option.
    If version is lower than 7.4, run the following command to check configuration:
    <sshd-check-macro default="yes" option="RhostsRSAAuthentication" value="no" />
