The SSH daemon must be configured to only use FIPS 140-2 approved ciphers.

From VMware vSphere ESXi 6.0 Security Technical Implementation Guide

Part of SRG-OS-000478-VMM-001980

Associated with: CCI-002450

SV-77991r2_rule The SSH daemon must be configured to only use FIPS 140-2 approved ciphers.

Vulnerability discussion

Approved algorithms should impart some level of confidence in their implementation. These are also required for compliance.Note: That this does not imply FIPS 140-2 certification.

Check content

Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command: # grep -i "^Ciphers" /etc/ssh/sshd_config If there is no output or the output is not exactly "Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc", this is a finding.

Fix text

Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. Add or correct the following line in "/etc/ssh/sshd_config": Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.