Check: APPL-13-000058
Apple macOS 13 (Ventura) STIG:
APPL-13-000058
(in versions v1 r4 through v1 r2)
Title
The macOS system must implement approved Message Authentication Codes (MACs) within the SSH client configuration. (Cat I impact)
Discussion
Operating systems using encryption are required to use FIPS-compliant mechanisms for authenticating to macOS. For OpenSSH to utilize the Apple Corecrypto FIPS-validated algorithms, a specific configuration is required to leverage the shim implemented by macOS to bypass the non-FIPS validated LibreSSL crypto module packaged with OpenSSH. Information regarding this configuration can be found in the manual page "apple_ssh_and_fips". Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00175
Check Content
Verify the macOS system is configured to use approved SSH MACs within the SSH client configuration with the following command: /usr/bin/sudo /usr/bin/grep -ir "macs" /etc/ssh/ssh_config* /etc/ssh/ssh_config.d/fips_ssh_config:Macs hmac-sha2-256 If any hashes other than "hmac-sha2-256" are listed, or the "macs" keyword is missing, this is a finding.
Fix Text
Configure the macOS system to use approved SSH MACs by creating a plain text file in the /private/etc/ssh/ssh_config.d/ directory containing the following: MACs hmac-sha2-256 The SSH service must be restarted for changes to take effect.
Additional Identifiers
Rule ID: SV-257294r919361_rule
Vulnerability ID: V-257294
Group Title: SRG-OS-000033-GPOS-00014
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000068 |
The information system implements cryptographic mechanisms to protect the confidentiality of remote access sessions. |
| CCI-000803 |
The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication. |
| CCI-000877 |
The organization employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions. |
| CCI-001453 |
The information system implements cryptographic mechanisms to protect the integrity of remote access sessions. |
| CCI-002890 |
The information system implements cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications. |
| CCI-003123 |
The information system implements cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications. |