STIG ID: RHEL-09-255160 | SRG: SRG-OS-000480-GPOS-00227 | Severity: medium | CCI: | Vulnerability Id: V-258008
If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.
Configure the SSH daemon to perform strict mode checking of home directory configuration files.
Add the following line in "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes":
StrictModes yes
The SSH service must be restarted for changes to take effect:
$ sudo systemctl restart sshd.service
Verify the SSH daemon performs strict mode checking of home directory configuration files with the following command:
$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*strictmodes'
StrictModes yes
If the "StrictModes" keyword is set to "no", the returned line is commented out, or no output is returned, this is a finding.