Check: GEN005505 M6
MACOSX 10.6:
GEN005505 M6
(in version v1 r3)
Title
The SSH daemon must be configured to only use FIPS 140-2 approved ciphers. (Cat II impact)
Discussion
DoD information systems are required to use FIPS 140-2 approved ciphers. SSHv2 ciphers meeting this requirement are 3DES and AES.
Check Content
Open a terminal session and enter the following command. grep -i ciphers /etc/sshd_config | grep -v '^#' If no lines are returned, or the returned ciphers list contains any cipher not starting with "3DES" or "AES", this is a finding.
Fix Text
Open a terminal session and edit the SSH daemon configuration file "/etc/sshd_config" to remove any ciphers not starting with "3DES" or "AES".
Additional Identifiers
Rule ID: SV-39360r1_rule
Vulnerability ID: V-22458
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000068 |
The information system implements cryptographic mechanisms to protect the confidentiality of remote access sessions. |
Controls
Number | Title |
---|---|
AC-17 (2) |
Protection Of Confidentiality / Integrity Using Encryption |