Disable Host-Based Authentication
Ensures SSH HostbasedAuthentication is set to no so clients cannot authenticate purely by virtue of their host identity.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Host-based authentication establishes trust relationships between machines, letting a user on a trusted host log in without per-user credentials. This means compromising one host lets an attacker move trivially to every host that trusts it, turning a single breach into lateral movement across the fleet. Disabling it forces real per-user authentication (keys, passwords) on every connection.
What Pavois checks
Pavois runs sshd -T and checks the effective hostbasedauthentication no line. sshd -T prints the fully resolved running configuration, including Match blocks, Included files and drop-ins under /etc/ssh/sshd_config.d/, so Pavois reports what sshd actually enforces, not what a single sshd_config line might say while a drop-in overrides it.
describe command('sshd -T 2>/dev/null | grep -qiE \'^hostbasedauthentication no\' && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run sshd -T | grep -i hostbasedauthentication. The expected output is hostbasedauthentication no.
Inspect & investigate
SSH authentication attempts and outcomes are logged in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL), and via journalctl -u ssh / journalctl -u sshd. The effective directive is confirmed with sshd -T | grep -i hostbased.
Remediation
No automated harden plan ships for this rule; apply it manually. Add HostbasedAuthentication no in a drop-in such as /etc/ssh/sshd_config.d/60-hardening.conf (it is also the sshd default), validate with sshd -t, then reload with systemctl reload ssh (or sshd).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| directive | HostbasedAuthentication |
|---|---|
| notify | action: reload, service: ssh.service |
| resource | sshd_setting |
| value | no |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Setting this to no is the sshd default and almost never disruptive, host-based auth is rarely used. The only systems affected are those that deliberately rely on ~/.shosts//etc/ssh/shosts.equiv trust (some HPC clusters or legacy rsh-style setups). If you operate such an environment, confirm an alternative (key-based) login path works before disabling it. Always run sshd -t before reloading to avoid breaking the SSH service on a remote host.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.1.10, 8.3.1, 5.1.12 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.12, AC-17(a), AC-3, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.3.1 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.