Title

The SSH daemon must not allow compression or must only allow compression after successful authentication. (Cat II impact)

Discussion

If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.

Check Content

Check the SSH daemon configuration for the Compression setting. # grep -i Compression /etc/ssh/sshd_config | grep -v '^#' If the setting is present and set to "yes", this is a finding. If the setting is absent or set to "no" or "delayed", this is not a finding.

Fix Text

Edit the /etc/ssh/sshd_config file and remove the Compression setting or set the Compression setting to "delayed" or "no".

Additional Identifiers

Rule ID: SV-40723r1_rule

Vulnerability ID: V-22488

Group Title: GEN005539

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.