STIGQter: STIG Summary: SLES 12 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The SUSE operating system SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.

DISA Rule

SV-217271r603959_rule

Vulnerability Number

V-217271

Group Title

SRG-OS-000125-GPOS-00065

Rule Version

SLES-12-030180

Severity

CAT II

CCI(s)

• CCI-001453 - The information system implements cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-000877 - The organization employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
• CCI-003123 - The information system implements cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Configure the SUSE operating system SSH daemon to only use MACs that employ FIPS 140-2 approved hashes.

Edit the "/etc/ssh/sshd_config" file to uncomment or add the line for the "MACs" keyword and set its value to "hmac-sha2-512" and/or "hmac-sha2-256" (The file might be named differently or be in a different location):

MACs hmac-sha2-512,hmac-sha2-256

Check Contents

Verify the SUSE operating system SSH daemon is configured to only use MACs that employ FIPS 140-2 approved hashes.

Check that the SSH daemon is configured to only use MACs that employ FIPS 140-2 approved hashes with the following command:

# sudo grep -i macs /etc/ssh/sshd_config
MACs hmac-sha2-512,hmac-sha2-256

If any hashes other than "hmac-sha2-512" or "hmac-sha2-256" are listed, the order differs from the example above, they are missing, or the returned line is commented out, this is a finding.

Vulnerability Number

V-217271

Documentable

False

Rule Version

SLES-12-030180

Severity Override Guidance

Verify the SUSE operating system SSH daemon is configured to only use MACs that employ FIPS 140-2 approved hashes.

Check that the SSH daemon is configured to only use MACs that employ FIPS 140-2 approved hashes with the following command:

# sudo grep -i macs /etc/ssh/sshd_config
MACs hmac-sha2-512,hmac-sha2-256

If any hashes other than "hmac-sha2-512" or "hmac-sha2-256" are listed, the order differs from the example above, they are missing, or the returned line is commented out, this is a finding.

Check Content Reference

M

Target Key

4033

Comments