# Ensure sshd IgnoreRhosts is enabled

Necessity: The `IgnoreRhosts` setting is crucial for disabling an obsolete and insecure authentication mechanism inherited from rsh/rlogin. These protocols use `.rhosts` and `.shosts` files for authentication based on hostnames, which are susceptible to DNS/IP spoofing. An attacker who compromises a trusted machine or spoofs its identity could gain unauthorized access to the server. Enabling `IgnoreRhosts` forces the use of stronger authentication methods like public key or password authentication, significantly reducing the risk of unauthorized access via legacy protocols.

Auditing and Remediation: The audit script inspects the `/etc/ssh/sshd_config` file to determine the currently active value for `IgnoreRhosts`, accounting for the default behavior if the line is absent. The remediation script directly modifies this configuration file to set `IgnoreRhosts` to the desired state and then reloads the SSH daemon to enforce the change.

Recommended State Rationale: 
- Basic: `['yes']`. This is the minimum acceptable security posture. Setting this to 'yes' explicitly disables the use of `.rhosts` and `.shosts` files, mitigating the associated risks. 
- Moderate: `['yes']`. As this is a binary security control, the only secure option is 'yes'. There is no intermediate state; the feature is either safely disabled or dangerously enabled. 
- Strict: `['yes']`. For the most secure environments, it is imperative that this setting is enabled. Any other configuration ('no') is considered a high-risk vulnerability, making 'yes' the only appropriate choice for all security hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['yes']` |
| **Moderate** | `['yes']` |
| **Strict** | `['yes']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the `/etc/ssh/sshd_config` file to find the value of the `IgnoreRhosts` setting. The script should handle cases where the setting is commented out or not present, returning the default value of 'yes' in such scenarios. The script must output only the effective value ('yes' or 'no') with no additional text or formatting.

## Remediation Script Working

Bash script that takes a single positional argument ('yes' or 'no') to configure the `IgnoreRhosts` setting in `/etc/ssh/sshd_config`. The script must find and update the existing `IgnoreRhosts` line or add it if it does not exist. After modifying the file, the script must reload the sshd service to apply the changes. It should return 'true' on successful completion and 'false' if any step fails.

