STIGQter: STIG Summary: VMware vSphere 6.5 ESXi Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

The ESXi host SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.

DISA Rule

SV-207618r388482_rule

Vulnerability Number

V-207618

Group Title

SRG-OS-000480-VMM-002000

Rule Version

ESXI-65-000017

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":

MACs hmac-sha1,hmac-sha2-256,hmac-sha2-512

Check Contents

From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:

# grep -i "^MACs" /etc/ssh/sshd_config

If there is no output or the output is not exactly "MACs hmac-sha1,hmac-sha2-256,hmac-sha2-512", this is a finding.

Vulnerability Number

V-207618

Documentable

False

Rule Version

ESXI-65-000017

Severity Override Guidance

From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:

# grep -i "^MACs" /etc/ssh/sshd_config

If there is no output or the output is not exactly "MACs hmac-sha1,hmac-sha2-256,hmac-sha2-512", this is a finding.

Check Content Reference

M

Target Key

2925

Comments