Windows Server 2025 OpenSSH must not allow GSSAPI authentication.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-285323 | SRG-OS-000364-GPOS-00151 | WN25-SH-000110 | SV-285323r1211197_rule | 2026-05-28 | 1 |
Description
Generic Security Service Application Program Interface (GSSAPI) authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system.
Satisfies: SRG-OS-000364-GPOS-00151, SRG-OS-000480-GPOS-00228
ℹ️ Check
If OpenSSH is not installed on the system, this requirement is not applicable.
Verify the system does not allow GSSAPI authentication with the following command:
C:\ > Get-Content "$env:ProgramData\ssh\sshd_config" | Select-String -Pattern '^\s*GSSAPIAuthentication'
GSSAPIAuthentication no
If the value is returned as "yes", the returned line is commented out, or no output is returned, this is a finding.
✔️ Fix
To configure the system, add or modify the following line in the "$env:ProgramData/ssh/sshd_config" file:
GSSAPIAuthentication no
Restart the OpenSSH service for the settings to take effect.