Title

The .rhosts file must not be supported in PAM. (Cat II impact)

Discussion

.rhosts files are used to specify a list of hosts permitted remote access to a particular account without authenticating. The use of such a mechanism defeats strong identification and authentication requirements.

Check Content

# cat /etc/pam.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep "^rcomds" | egrep "auth|account" | egrep "libpam_unix|libpam_hpsec" NOTE: The entries in /etc/pam.conf Authentication and Account management sections should be configured as follows: # Authentication management rcomds auth required libpam_hpsec.so.1 rcomds auth required libpam_unix.so.1 # Account management rcomds account required libpam_hpsec.so.1 rcomds account required libpam_unix.so.1 The remsh and rexec services use the above entries as configuration information for authenticating users. Adding these entries in the /etc/pam.conf file informs rexec and remsh to use the standard UNIX authentication mechanism to authenticate the users, including the inspection of the .rhosts file.

Fix Text

Edit /etc/pam.conf and comment/remove the "rcomds" line(s).

Additional Identifiers

Rule ID: SV-38264r1_rule

Vulnerability ID: V-11989

Group Title: GEN002100

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.