# Ensure sshd IgnoreRhosts is enabled

Necessity: The 'IgnoreRhosts' setting controls whether sshd will use rhosts-based authentication, which relies on `.rhosts` and `/etc/hosts.equiv` files. This is a legacy and insecure authentication method that trusts client hostnames, which can be easily spoofed. Enabling 'IgnoreRhosts' (setting it to 'yes') disables this weak authentication mechanism, mitigating the risk of unauthorized access if an attacker compromises a trusted client or spoofs its identity. 

Auditing and Remediation: The audit script directly queries the running SSH server's effective configuration to determine the status of 'IgnoreRhosts'. The remediation script modifies the '/etc/ssh/sshd_config' file to enforce the recommended state, ensuring the insecure rhosts authentication is disabled, and then restarts the service to apply the change.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'yes'. Rhosts authentication is considered obsolete and fundamentally insecure for modern systems. There is no legitimate security use case for disabling this setting. Therefore, all security postures demand that 'IgnoreRhosts' be enabled to eliminate this attack vector entirely.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['yes']` |
| **Moderate** | `['yes']` |
| **Strict** | `['yes']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the effective SSH server configuration for the 'IgnoreRhosts' setting using the `sshd -T` command. The script must parse the output to return only the current value (e.g., 'yes'), with no additional text or labels.

## Remediation Script Working

Develop a Bash script that accepts a single positional argument ('yes' or 'no') to set the 'IgnoreRhosts' directive in '/etc/ssh/sshd_config'. The script must either modify the existing line (commented or uncommented) or append it if it does not exist. After modifying the file, it must restart the sshd service to apply the change. The script must output 'true' on success and 'false' on failure.

