name: cis-ubuntu1804-v220-4-2-10 description: "Ensure sshd IgnoreRhosts is enabled" category: cis-networking version: "2.2.0" author: cyberstrike-official tags: [cis, ubuntu, linux, ubuntu-18.04, ssh, remote-access] cis_id: "4.2.10" cis_benchmark: "CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0" tech_stack: [ubuntu, linux] cwe_ids: [] chains_with: [] prerequisites: [] severity_boost: {}

CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 4.2.10

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

The IgnoreRhosts parameter specifies that .rhosts and .shosts files will not be used in RhostsRSAAuthentication or HostbasedAuthentication.

Rationale

Setting this parameter forces users to enter a password when authenticating with SSH.

Audit Procedure

Command Line

Run the following command and verify the output:

sshd -T | grep -i ignorerhosts

Expected Result

ignorerhosts yes

Remediation

Command Line

Edit the /etc/ssh/sshd_config file to set the parameter as follows:

IgnoreRhosts yes

Default Value

IgnoreRhosts yes

References

1. NIST SP 800-53 Rev. 5: CM-7

CIS Controls

v8 - 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software.

v7 - 9.2 Ensure Only Approved Ports, Protocols, and Services Are Running.

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Assessment Status

Automated