# Ensure sshd HostbasedAuthentication is disabled

Necessity: Host-based authentication allows users to log in without a password if their client machine's hostname and public key are listed as trusted on the server. This method is inherently insecure as it relies on the integrity of the client machine and network name resolution (DNS), both of which can be compromised or spoofed. An attacker who gains control of a trusted client machine could gain unauthorized access to the server. Disabling this feature enforces stronger, user-specific authentication methods such as public key or password authentication.

Auditing and Remediation: The audit script checks the active configuration of the SSH daemon to determine the current state of the 'HostbasedAuthentication' setting. The remediation script directly modifies the '/etc/ssh/sshd_config' file to explicitly set 'HostbasedAuthentication' to 'no', ensuring the insecure authentication method is disabled.

Recommended State Rationale: 
Basic, Moderate, and Strict: All security levels recommend a state of ['no']. This is a fundamental security control with no room for permissive settings. Host-based authentication is a legacy feature that bypasses modern, per-user authentication requirements. For any level of security hardening, it must be disabled to mitigate the risk of unauthorized access from compromised but 'trusted' network hosts. There is no secure use case for enabling it in a modern environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['no']` |
| **Moderate** | `['no']` |
| **Strict** | `['no']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that queries the effective SSH daemon configuration for the 'hostbasedauthentication' setting. The script must parse the output of 'sshd -T' and return only the value (e.g., 'no' or 'yes'), without any additional text or formatting.

## Remediation Script Working

bash script that accepts a single positional argument ('yes' or 'no'). The script must modify the '/etc/ssh/sshd_config' file to set the 'HostbasedAuthentication' directive to the provided value. If the directive exists but is commented out, it should be uncommented. If it does not exist, it should be added. The script must return 'true' on success and 'false' on failure.

