← Back to VMware vSphere 7.0 ESXi Security Technical Implementation Guide

V-256385

CAT II (Medium)

The ESXi host Secure Shell (SSH) daemon must ignore ".rhosts" files.

Rule ID

SV-256385r984206_rule

STIG

VMware vSphere 7.0 ESXi Security Technical Implementation Guide

Version

V1R4

CCIs

CCI-000767

Discussion

SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH can emulate the behavior of the obsolete "rsh" command in allowing users to enable insecure access to their accounts via ".rhosts" files.

Check Content

From an ESXi shell, run the following command:

# /usr/lib/vmware/openssh/bin/sshd -T|grep ignorerhosts

Expected result:

ignorerhosts yes

If the output does not match the expected result, this is a finding.

Fix Text

From an ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":

IgnoreRhosts yes