← Back to IBM AIX 7.x Security Technical Implementation Guide

V-215298

CAT II (Medium)

AIX must turn on SSH daemon reverse name checking.

Rule ID

SV-215298r991589_rule

STIG

IBM AIX 7.x Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000366

Discussion

If reverse name checking is off, SSH may allow a remote attacker to circumvent security policies and attempt to or actually login from IP addresses that are not permitted to access resources.

Check Content

Check the SSH daemon configuration for the "VerifyReverseMapping" setting using command: 

# grep -i VerifyReverseMapping  /etc/ssh/sshd_config | grep -v '^#' 
VerifyReverseMapping yes

If the setting is not present or the setting is "no", this is a finding.

Fix Text

Edit the "/etc/sshd/sshd_config" file and add the following line:
VerifyReverseMapping yes

Restart the SSH daemon:
# stopsrc -s sshd
# startsrc -s sshd