# Ensure sshd GSSAPIAuthentication is disabled

Necessity: GSSAPI (Generic Security Service Application Program Interface) provides a mechanism for single sign-on, typically using Kerberos. If the system is not part of a managed authentication domain that uses GSSAPI (like Active Directory or FreeIPA), this authentication method is unnecessary. Disabling unused authentication mechanisms is a critical security principle, as it reduces the SSH daemon's attack surface. A vulnerability in the GSSAPI implementation could be exploited even if it is not actively used for logins, so disabling it mitigates this risk.

Auditing and Remediation: The audit script directly queries the running SSH daemon's configuration to get the effective value for 'GSSAPIAuthentication', ensuring it reflects the actual state regardless of how the configuration file is structured. The remediation script modifies the '/etc/ssh/sshd_config' file to explicitly set 'GSSAPIAuthentication' to the desired state and then reloads the service, ensuring the change is applied.

Recommended State Rationale: The recommendation for all security levels (Basic, Moderate, and Strict) is to set this value to 'no'. This is a binary setting where the secure state is 'disabled' unless there is an explicit operational requirement for GSSAPI. Enabling an unused, complex authentication protocol introduces unnecessary risk with no benefit. Therefore, a consistent recommendation to disable it is appropriate for any baseline security hardening standard.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['no']` |
| **Moderate** | `['no']` |
| **Strict** | `['no']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the effective SSH server configuration for the value of 'GSSAPIAuthentication'. The script must only output the resulting value (e.g., 'no' or 'yes'). A reliable method is to use 'sshd -T | grep -i '^gssapiauthentication' | awk '{print $2}''.

## Remediation Script Working

Bash script that accepts a single positional argument ('yes' or 'no') to set the 'GSSAPIAuthentication' parameter in '/etc/ssh/sshd_config'. The script must find and replace the existing value or append the parameter if it does not exist. After modifying the file, the script must reload or restart the 'sshd' service to apply the changes. It must output 'true' on success and 'false' on failure.

