Disable SSH Support for .rhosts Files
Forces IgnoreRhosts yes so SSH ignores .rhosts and .shosts files when authenticating users.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
.rhosts/.shosts files implement host-based trust: they let a user from a named host log in without supplying a credential. This trust is based on easily-spoofed source addresses and means that compromising one host lets an attacker move trivially to every host that trusts it. IgnoreRhosts yes tells SSH to disregard these files entirely, closing this credential-less lateral-movement path.
What Pavois checks
Pavois reads the effective value from sshd -T, after every Include, /etc/ssh/sshd_config.d/ drop-in and Match block. A Match stanza can re-enable rhosts trust for a specific user or address range; only the resolved output exposes that, unlike a read of /etc/ssh/sshd_config.
describe command('sshd -T') do
its('stdout') { should match(/^ignorerhosts\s+yes$/i) }
endHow to verify it is applied
Run sshd -T | grep -i '^ignorerhosts'. Expected output is ignorerhosts yes.
Inspect & investigate
Host-based authentication attempts are logged in /var/log/auth.log (Debian/Ubuntu) or journalctl -u sshd (RHEL family); a rejected rhosts login appears as a failed authentication line.
Remediation
Pavois's harden plan writes the sshd_setting directive IgnoreRhosts yes in a managed drop-in, validates with sshd -t, then reloads the ssh service. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| directive | ignorerhosts |
|---|---|
| notify | action: reload, service: ssh.service |
| resource | sshd_setting |
| value | yes |
| verify | sshd -t -f %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Practically no impact in any modern environment: host-based .rhosts trust is obsolete and almost never legitimately used. The only thing this breaks is intentional rhosts-based authentication; if you depend on it (rare), migrate to key-based auth first. The reload preserves active sessions.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.2.6, 5.1.11, 5.1.13 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.12, AC-17(a), CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.