Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive.
keyword=RhostsRSAAuthentication
arg(s)=no
Default values include: "no"
Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior.
Examine the file.
# cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "RhostsRSAAuthentication"
This option currently applies only to Protocol Version 1. If using Protocol 1 or any variant of Protocol 1, IE:
Protocol 1,2
OR
Protocol 2,1
and configuration information is not returned or the return value is yes, this is a finding. If using Protocol 2, this is Not Applicable (NA).