The SSH daemon must be configured to use SAF keyrings for key storage.

SV-83859r1_rule The SSH daemon must be configured to use SAF keyrings for key storage.

Vulnerability discussion

The use of SAF Key Rings for key storage enforces organizational access control policies and assures the protection of cryptographic keys in storage.

Check content

Locate the SSH daemon configuration file. May be found in /etc/ssh/ directory. Alternately: From UNIX System Services ISPF Shell navigate to ribbon select tools. Select option 1 - Work with Processes. If SSH Daemon is not active there is no finding. Examine the file. Ensure the following are either not coded or commented out: #HostKey for protocol version 1 #HostKey /etc/ssh/ssh_host_key #HostKeys for protocol version 2 #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key Locate the z/OS-specific sshd server system-wide configuration file. zos_sshd_config May be found in /etc/ssh/ directory. Ensure that a HostKeyRingLabel line is coded and not commented out. If either of the above is not true this is a finding.

Fix text

Configure the SSH Daemon configuration file with the following statements Ensure that the following is either not coded or comment out. #HostKey for protocol version 1 #HostKey /etc/ssh/ssh_host_key #HostKeys for protocol version 2 #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key Configure the zos_sshd_config with the HostKeyRingLabel Statement. Example: HostKeyRingLabel="SSHDAEM/SSHDring my label"

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.