STIGQter: STIG Summary: Apple OS X 10.14 (Mojave) Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The macOS system must use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.

DISA Rule

SV-233691r610285_rule

Vulnerability Number

V-233691

Group Title

SRG-OS-000033-GPOS-00014

Rule Version

AOSX-14-000055

Severity

CAT II

CCI(s)

• CCI-000803 - The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
• CCI-000877 - The organization employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
• CCI-000068 - The information system implements cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-003123 - The information system implements cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
• CCI-002890 - The information system implements cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Configure SSH to use secure Keyed-Hash Message Authentication Codes.

To ensure that "MACs" set correctly, run the following command:

/usr/bin/sudo /usr/bin/grep -q '^MACs' /etc/ssh/sshd_config && /usr/bin/sudo /usr/bin/sed -i.bak 's/^MACs.*/MACs hmac-sha2-256,hmac-sha2-512/' /etc/ssh/sshd_config || /usr/bin/sudo /usr/bin/sed -i.bak '/.*Ciphers and keying.*/a\'$'\n''MACs hmac-sha2-512,hmac-sha2-256'$'\n' /etc/ssh/sshd_config

The SSH service must be restarted for changes to take effect.

Check Contents

If SSH is not being used, this is Not Applicable.

Inspect the "MACs" configuration with the following command:
Note: The location of the "sshd_config" file may vary if a different daemon is in use.

/usr/bin/grep "^Macs" /etc/ssh/sshd_config

MACs hmac-sha2-512,hmac-sha2-256

If any hashes other than "hmac-sha2-512" and/or "hmac-sha2-256" are listed, the order differs from the example above, or the "MACs" keyword is missing, this is a finding.

Vulnerability Number

V-233691

Documentable

False

Rule Version

AOSX-14-000055

Severity Override Guidance

If SSH is not being used, this is Not Applicable.

Inspect the "MACs" configuration with the following command:
Note: The location of the "sshd_config" file may vary if a different daemon is in use.

/usr/bin/grep "^Macs" /etc/ssh/sshd_config

MACs hmac-sha2-512,hmac-sha2-256

If any hashes other than "hmac-sha2-512" and/or "hmac-sha2-256" are listed, the order differs from the example above, or the "MACs" keyword is missing, this is a finding.

Check Content Reference

M

Target Key

2930

Comments