The VMM must use DoD-approved encryption to protect the confidentiality of remote access sessions.

From VMware vSphere ESXi 6.0 Security Technical Implementation Guide

Associated with: CCI-000068

SV-77679r2_rule The VMM must use DoD-approved encryption to protect the confidentiality of remote access sessions.

Vulnerability discussion

Approved algorithms should impart some level of confidence in their implementation. These are also required for compliance.Note: This does not imply FIPS 140-2 certification.

Check content

Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command: # grep -i "^Ciphers" /etc/ssh/sshd_config If there is no output or the output is not exactly "Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc", this is a finding.

Fix text

Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. Add or correct the following line in "/etc/ssh/sshd_config": Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.