An error occurred:

Check: RHEL-09-255035

RHEL 9 STIG: RHEL-09-255035 (in version v2 r3)

Title

RHEL 9 SSHD must accept public key authentication. (Cat II impact)

Discussion

Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. A DOD common access card (CAC) with DOD-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055

Check Content

Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is Not Applicable. Verify that RHEL 9 SSH daemon accepts public key encryption with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*pubkeyauthentication' PubkeyAuthentication yes If "PubkeyAuthentication" is set to no, the line is commented out, or the line is missing, this is a finding.

Fix Text

To configure the system, add or modify the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d". PubkeyAuthentication yes Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

Additional Identifiers

Rule ID: SV-257983r1045024_rule

Vulnerability ID: V-257983

Group Title: SRG-OS-000105-GPOS-00052

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.
Number Definition
CCI-000765

Implement multifactor authentication for access to privileged accounts.
CCI-000766

Implement multifactor authentication for access to non-privileged accounts.
CCI-000767

The information system implements multifactor authentication for local access to privileged accounts.
CCI-000768

The information system implements multifactor authentication for local access to non-privileged accounts.

Controls

Controls tied to check. These are derived from the CCIs shown above.
Number Title
IA-2(1)

Network Access to Privileged Accounts
IA-2(2)

Network Access to Non-privileged Accounts
IA-2(3)

Local Access to Privileged Accounts
IA-2(4)

Local Access to Non-privileged Accounts