Check: PHTN-67-000093
VMware vSphere 6.7 Photon OS STIG:
PHTN-67-000093
(in versions v1 r6 through v1 r1)
Title
The Photon operating system must configure sshd to ignore user-specific known_host files. (Cat II impact)
Discussion
SSH trust relationships enable trivial lateral spread after a host compromise and therefore must be explicitly disabled. Individual users can have a local list of trusted remote machines which must also be ignored while disabling host-based authentication generally.
Check Content
At the command line, execute the following command: # sshd -T|&grep -i IgnoreUserKnownHosts Expected result: IgnoreUserKnownHosts yes If the output does not match the expected result, this is a finding.
Fix Text
Open /etc/ssh/sshd_config with a text editor. Ensure that the "IgnoreUserKnownHosts" line is uncommented and set to the following: IgnoreUserKnownHosts yes At the command line, execute the following command: # service sshd reload
Additional Identifiers
Rule ID: SV-239164r675300_rule
Vulnerability ID: V-239164
Group Title: SRG-OS-000480-GPOS-00227
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |