# Ensure sshd HostbasedAuthentication is disabled

Necessity: Host-based authentication allows users to log in if their client machine's hostname and username appear in specific server-side configuration files. This method is inherently insecure because it relies on the integrity of network information (DNS and IP addresses), which can be spoofed. An attacker who compromises a trusted client or spoofs its network identity could gain unauthorized access to the server. Disabling it mandates stronger authentication methods like public key or password authentication, significantly reducing the attack surface. The primary risk of leaving this enabled is unauthorized server access.

Auditing and Remediation: The audit script inspects the `/etc/ssh/sshd_config` file to determine the currently active value for the `HostbasedAuthentication` directive. The remediation script directly modifies this configuration file to set the directive to 'no', ensuring the insecure authentication method is disabled, and then restarts the SSH service for the change to take effect.

Recommended State Rationale: The recommended state is consistently 'no' across all security levels because there is no secure use case for this authentication method in modern environments. 
- Basic: `['no']` is the minimum requirement for a secure system, as recommended by security standards like the CIS Benchmarks. It closes a well-known vulnerability.
- Moderate: `['no']` remains the recommendation, as there is no middle ground for this setting. It is either enabled (insecure) or disabled (secure).
- Strict: `['no']` is the only acceptable state for a strictly hardened system. Disabling it entirely ensures that authentication relies on stronger, cryptographically-backed credentials, eliminating the risk of network identity spoofing attacks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['no']` |
| **Moderate** | `['no']` |
| **Strict** | `['no']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the `/etc/ssh/sshd_config` file for the `HostbasedAuthentication` setting. The script should parse the file to find the active configuration value. If the setting is explicitly set to 'yes' or 'no', return that value. If the setting is commented out or not present, return the default value 'no'. The script must only output the resulting value (e.g., 'no') without any additional text or labels.

## Remediation Script Working

Bash script that takes a single positional argument ('yes' or 'no') to configure the `HostbasedAuthentication` setting in the `/etc/ssh/sshd_config` file. The script must find the existing `HostbasedAuthentication` line (even if commented out) and replace it, or append the setting if it does not exist. After modifying the file, the script must restart the SSH service to apply the change. The script must return 'true' upon successful modification and service restart, and 'false' otherwise.

