# Ensure sshd GSSAPIAuthentication is disabled

Necessity: GSSAPI (Generic Security Service Application Program Interface) provides mechanisms for authenticating users, typically with Kerberos. If the system is not part of a Kerberos infrastructure, this authentication method is unnecessary. Disabling it reduces the attack surface of the SSH daemon by removing a complex and potentially vulnerable authentication mechanism, adhering to the security principle of minimizing functionality.

Auditing and Remediation: The audit script inspects the active SSH server configuration to determine the current state of the 'GSSAPIAuthentication' directive. The remediation script directly modifies the '/etc/ssh/sshd_config' file to set the value to 'no' and then restarts the SSH service for the change to take effect.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'no'. This is a binary security setting; it should be enabled only if specifically required for Kerberos authentication. For all other systems, it should be disabled to minimize security risks. There is no intermediate 'moderate' configuration. Therefore, unless there is a documented operational requirement, disabling GSSAPIAuthentication is the universal best practice for security hardening.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['no']` |
| **Moderate** | `['no']` |
| **Strict** | `['no']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that queries the active SSH server configuration for the value of 'gssapiauthentication'. The script must output only the value (e.g., 'yes' or 'no'), with no additional text or labels.

## Remediation Script Working

bash script that takes a single positional argument (e.g., 'yes' or 'no') and sets the 'GSSAPIAuthentication' option in the '/etc/ssh/sshd_config' file to that value. The script must create the entry if it does not exist. After modifying the file, it must restart the SSH service to apply the change. The script must return 'true' on success and 'false' on failure.

