UCF STIG Viewer Logo

The ESXi host SSH daemon must not permit GSSAPI authentication.


Overview

Finding ID Version Rule ID IA Controls Severity
V-239273 ESXI-67-000018 SV-239273r674748_rule Low
Description
GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system’s GSSAPI to remote hosts, increasing the attack surface of the system.
STIG Date
VMware vSphere 6.7 ESXi Security Technical Implementation Guide 2022-01-05

Details

Check Text ( C-42506r674746_chk )
From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:

# grep -i "^GSSAPIAuthentication" /etc/ssh/sshd_config

If there is no output or the output is not exactly "GSSAPIAuthentication no", this is a finding.
Fix Text (F-42465r674747_fix)
From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":

GSSAPIAuthentication no