documentation_complete: true

title: 'Disable Host-Based Authentication'

description: |-
    SSH's cryptographic host-based authentication is
    more secure than <tt>.rhosts</tt> authentication. However, it is
    not recommended that hosts unilaterally trust one another, even
    within an organization.
    <br /><br />
    To disable host-based authentication, add or correct the
    following line in <tt>/etc/ssh/sshd_config</tt>:
    <pre>HostbasedAuthentication no</pre>

rationale: |-
    SSH trust relationships mean a compromise on one host
    can allow an attacker to move trivially to other hosts.

severity: medium

identifiers:
    cce: 27091-8

references:
    disa: 765,766
    nist: AC-3
    srg: SRG-OS-000106
    stigid: RHEL-06-000236

ocil: '<sshd-check-macro default="yes" option="HostbasedAuthentication" value="no" />'
