From VMware ESXi Server 5.0 Security Technical Implementation Guide
Part of SRG-OS-000157
Associated with: CCI-001127
The Cipher-Block Chaining (CBC) mode of encryption as implemented in the SSHv2 protocol is vulnerable to chosen plain text attacks and must not be used.
Disable lock down mode. Enable the ESXi Shell. Check the SSH client configuration for allowed ciphers. # grep -i ciphers /etc/ssh/ssh_config | grep -v '^#' Re-enable lock down mode. If the returned ciphers list contains any cipher ending with cbc, this is a finding. If the /etc/ssh/ssh_config file does not exist or the Ciphers option is not set, this is not a finding.
Disable lock down mode. Enable the ESXi Shell. Edit the SSH client configuration and add/modify the "Ciphers" configuration (examples of disallowed ciphers: aes128-cbc, aes192-cbc, aes256-cbc, arcfour256blowfish-cbc, cast128-cbc, 3des-cbc). # vi /etc/ssh/ssh_config Re-enable lock down mode.
Lavender hyperlinks in small type off to the right (of CSS
class id
, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle
or
Accept: application/rdf+xml
.
Powered by sagemincer