documentation_complete: true

title: 'Disable SSH Support for .rhosts Files'

description: |-
    SSH can emulate the behavior of the obsolete rsh
    command in allowing users to enable insecure access to their
    accounts via <tt>.rhosts</tt> files.
    <br /><br />
    To ensure this behavior is disabled, add or correct the
    following line in <tt>/etc/ssh/sshd_config</tt>:
    <pre>IgnoreRhosts yes</pre>

rationale: |-
    SSH trust relationships mean a compromise on one host
    can allow an attacker to move trivially to other hosts.

severity: medium

identifiers:
    cce: 27124-7

references:
    disa: 765,766
    nist: AC-3
    srg: SRG-OS-000106
    stigid: RHEL-06-000234

ocil: '<sshd-check-macro default="yes" option="IgnoreRhosts" value="yes" />'
