STIGQter: STIG Summary: Solaris 11 X86 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The operating system must implement DoD-approved encryption to protect the confidentiality of remote access sessions.

DISA Rule

SV-216173r603879_rule

Vulnerability Number

V-216173

Group Title

SRG-OS-000033

Rule Version

SOL-11.1-060130

Severity

CAT II

CCI(s)

• CCI-000068 - The information system implements cryptographic mechanisms to protect the confidentiality of remote access sessions.

Weight

10

Fix Recommendation

The root role is required.

Modify the sshd_config file.

# pfedit /etc/ssh/sshd_config

Change or set the ciphers line to the following:

ciphers aes256-ctr,aes192-ctr,aes128-ctr

Restart the SSH service.

# svcadm restart svc:/network/ssh

Check Contents

Check the SSH daemon configuration for allowed ciphers.

# grep -i ciphers /etc/ssh/sshd_config | grep -v '^#’
Ciphers aes256-ctr,aes192-ctr,aes128-ctr

If any ciphers other than "aes256-ctr", "aes192-ctr", or "aes128-ctr" are listed, the order differs from the example above, the "Ciphers" keyword is missing, or is commented out, this is a finding.

Vulnerability Number

V-216173

Documentable

False

Rule Version

SOL-11.1-060130

Severity Override Guidance

Check the SSH daemon configuration for allowed ciphers.

# grep -i ciphers /etc/ssh/sshd_config | grep -v '^#’
Ciphers aes256-ctr,aes192-ctr,aes128-ctr

If any ciphers other than "aes256-ctr", "aes192-ctr", or "aes128-ctr" are listed, the order differs from the example above, the "Ciphers" keyword is missing, or is commented out, this is a finding.

Check Content Reference

M

Target Key

4021

Comments