Title

The .rhosts file must not be supported in PAM. (Cat II impact)

Discussion

.rhosts files are used to specify a list of hosts permitted remote access to a particular account without authenticating. The use of such a mechanism defeats strong identification and authentication requirements.

Check Content

Verify the remsh and rexec services have not been configured to use the PAM module: # cat /etc/pam.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep "^rcomds" | egrep "auth|account" | egrep "libpam_unix|libpam_hpsec" If any of the following lines are returned, this is a finding. rcomds auth required libpam_hpsec.so.1 rcomds auth required libpam_unix.so.1 rcomds account required libpam_hpsec.so.1 rcomds account required libpam_unix.so.1

Fix Text

Edit /etc/pam.conf and comment/remove the "rcomds" line(s).

Additional Identifiers

Rule ID: SV-38264r2_rule

Vulnerability ID: V-11989

Group Title: GEN002100

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.