Disable Kerberos Authentication
Forces KerberosAuthentication no so SSH does not offer direct Kerberos password validation as an auth method.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Kerberos authentication for SSH (often implemented on top of GSSAPI) exposes the system's Kerberos implementation to remote clients. On a host that is not part of a Kerberos realm this is an unused authentication path that only enlarges the attack surface. Disabling it ensures the SSH daemon does not fall back to unused authentication methods, even if a misconfiguration elsewhere would otherwise enable them.
What Pavois checks
Pavois reads the effective value from sshd -T, resolved after all Includes, /etc/ssh/sshd_config.d/ drop-ins and Match blocks (including RHEL crypto-policy includes). A read of /etc/ssh/sshd_config would not reveal a KerberosAuthentication yes set in an included fragment.
describe command('sshd -T') do
its('stdout') { should match(/^kerberosauthentication\s+no$/i) }
endHow to verify it is applied
Run sshd -T | grep -i '^kerberosauthentication'. Expected output is kerberosauthentication no.
Inspect & investigate
Authentication negotiation and failures are logged via journalctl -u sshd (RHEL family) or in /var/log/secure; use LogLevel VERBOSE for the method offered to each connection.
Remediation
Pavois's harden plan writes the sshd_setting directive KerberosAuthentication no in a managed drop-in, validates with sshd -t, then reloads the ssh service. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| directive | kerberosauthentication |
|---|---|
| notify | action: reload, service: ssh.service |
| resource | sshd_setting |
| value | no |
| verify | sshd -t -f %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Before applying, confirm the host is not Kerberos/AD-joined and that no user authenticates via Kerberos-backed passwords over SSH. On a standalone host there is no impact. If Kerberos SSO is required, keep this enabled and rely on other hardening. The reload preserves active sessions.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | 3.1.12 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.