STIGQter: STIG Summary: Oracle Linux 6 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The Oracle Linux 6 operating system must implement DoD-approved encryption to protect the confidentiality of SSH connections.

DISA Rule

SV-219561r603343_rule

Vulnerability Number

V-219561

Group Title

SRG-OS-000250

Rule Version

OL6-00-000243

Severity

CAT II

CCI(s)

• CCI-001453 - The information system implements cryptographic mechanisms to protect the integrity of remote access sessions.

Weight

10

Fix Recommendation

Limit the ciphers to those algorithms which are FIPS-approved. The following line in "/etc/ssh/sshd_config" demonstrates use of FIPS-approved ciphers:

Ciphers 256-ctr,aes192-ctr,aes128-ctr

Note: The man page "sshd_config(5)" contains a list of supported ciphers.

Check Contents

Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command:

# grep -i Ciphers /etc/ssh/sshd_config

Ciphers aes256-ctr,aes192-ctr,aes128-ctr

If any ciphers other than "aes256-ctr", "aes192-ctr", or "aes128-ctr" are listed, the order differs from the example above, the "Ciphers" keyword is missing, or the returned line is commented out, this is a finding.

Vulnerability Number

V-219561

Documentable

False

Rule Version

OL6-00-000243

Severity Override Guidance

Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command:

# grep -i Ciphers /etc/ssh/sshd_config

Ciphers aes256-ctr,aes192-ctr,aes128-ctr

If any ciphers other than "aes256-ctr", "aes192-ctr", or "aes128-ctr" are listed, the order differs from the example above, the "Ciphers" keyword is missing, or the returned line is commented out, this is a finding.

Check Content Reference

M

Target Key

2928

Comments