Other Articles

Servers – Ensure SSH IgnoreRhosts is Enabled

Support > Fixing Checks > Server

06 March, 2026

This check ensures that the SSH IgnoreRhosts parameter is enabled in the SSH configuration file.

Enabling IgnoreRhosts prevents the use of .rhosts and .shosts files for authentication, reducing the risk of unauthorized access through trust-based mechanisms.

Check Details

  • Resource: Server
  • Check: Ensure SSH IgnoreRhosts is enabled
  • Risk: If disabled, attackers may exploit trust-based authentication using .rhosts or .shosts files, bypassing secure login mechanisms.

Remediation Steps

  1. Open a terminal session on the server with root or sudo privileges.

  2. Open the SSH configuration file using a text editor:

    sudo nano /etc/ssh/sshd_config
  3. Locate the IgnoreRhosts parameter. If it does not exist, add it.

  4. Set the parameter as follows:

    IgnoreRhosts yes
  5. Save the file and exit the editor.

  6. Restart the SSH service to apply the changes:

    sudo systemctl restart sshd

  7. Verify the configuration using the following command:

    sshd -T | grep ignorerhosts

  8. Ensure the output shows:

    ignorerhosts yes
  9. Perform periodic audits to ensure the configuration remains enforced.