STIGQter: STIG Summary: Solaris 10 SPARC Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

The operating system must implement DoD-approved encryption to protect the confidentiality of SSH connections.

DISA Rule

SV-226986r603852_rule

Vulnerability Number

V-226986

Group Title

SRG-OS-000033

Rule Version

GEN005505

Severity

CAT II

CCI(s)

• CCI-000068 - The information system implements cryptographic mechanisms to protect the confidentiality of remote access sessions.

Weight

10

Fix Recommendation

Edit /etc/ssh/sshd_config and change or set the Ciphers line to the following.

Ciphers aes256-ctr, aes192-ctr, aes128-ctr

Check Contents

Check the SSH daemon configuration for allowed ciphers.

# grep -i ciphers /etc/ssh/sshd_config | grep -v '^#'

Ciphers aes256-ctr,aes192-ctr,aes128-ctr

If any ciphers other than "aes256-ctr", "aes192-ctr", or "aes128-ctr" are listed, the order differs from the example above, the "Ciphers" keyword is missing, or is commented out, this is a finding.

Vulnerability Number

V-226986

Documentable

False

Rule Version

GEN005505

Severity Override Guidance

Check the SSH daemon configuration for allowed ciphers.

# grep -i ciphers /etc/ssh/sshd_config | grep -v '^#'

Ciphers aes256-ctr,aes192-ctr,aes128-ctr

If any ciphers other than "aes256-ctr", "aes192-ctr", or "aes128-ctr" are listed, the order differs from the example above, the "Ciphers" keyword is missing, or is commented out, this is a finding.

Check Content Reference

M

Target Key

4060

Comments