SV-216120r959010: Host-based authentication for login-based services must be disabled. | Solaris 11 X86 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Host-based authentication for login-based services must be disabled.

Description

Discussion Text

The use of .rhosts authentication is an insecure protocol and can be replaced with public-key authentication using Secure Shell. As automatic authentication settings in the .rhosts files can provide a malicious user with sensitive system credentials, the use of .rhosts files should be disabled.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366V-48113SV-60985

References

DPMS Target Solaris 11 X86 DISA DPMS Target Solaris 11 X86 4021

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.solaris11:def:70
# Host-based authentication for login-based services must be disabled.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# No files in /etc/pam.d contain the line pam_rhosts_auth.so.1.
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  ! ( grep -rqP --include='*' '^[^#]*pam_rhosts_auth\.so\.1.*$' '/etc/pam.d' &>/dev/null )
}
# /etc/pam.conf does not contain the line pam_rhosts_auth.so.1.
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  ! ( grep -Pq '^[^#]*pam_rhosts_auth\.so\.1.*$' '/etc/pam.conf' &>/dev/null )
}

if ( test_1 && test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# This script implements DISA STIG / SCAP compliance check oval:mil.disa.stig.solaris11:def:70

if [ ! -d "/etc/pam.d" ]; then echo "PASS"; exit 0; fi
for file in /etc/pam.d/*; do
    if [ -f "$file" ]; then
        if ! grep -q "^[^#]*pam_rhosts_auth\\.so\\.1.*$" "$file"; then continue; fi
        echo "FAIL"; exit 1
    fi
done

if [ ! -f "/etc/pam.conf" ]; then echo "PASS"; exit 0; fi
if ! grep -q "^[^#]*pam_rhosts_auth\\.so\\.1.*$" "/etc/pam.conf"; then echo "PASS"; exit 0; fi
echo "FAIL"; exit 1

Remediation

Note: This is the location for Solaris 11.1. For earlier versions, the information is in /etc/pam.conf.

The root role is required.

# ls -l /etc/pam.d
to identify the various configuration files used by PAM.

Search each file for the pam_rhosts_auth.so.1 entry.

# grep pam_rhosts_auth.so.1 [filename]

Identify the file with the line pam_hosts_auth.so.1 in it.

# pfedit [filename]

Insert a comment character (#) at the beginning of the line containing "pam_hosts_auth.so.1".