STIGQter: STIG Summary: Apple macOS 11 (Big Sur) Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 23 Apr 2021:

The macOS system must implement an approved Key Exchange Algorithm.

DISA Rule

SV-230769r599842_rule

Vulnerability Number

V-230769

Group Title

SRG-OS-000033-GPOS-00014

Rule Version

APPL-11-000056

Severity

CAT II

CCI(s)

• CCI-000803 - The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
• CCI-000068 - The information system implements cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-002890 - The information system implements cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
• CCI-003123 - The information system implements cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Configure SSH to use a secure Key Exchange Algorithm.

To ensure that "KexAlgorithms" set correctly, run the following command:

/usr/bin/sudo /usr/bin/grep -q '^KexAlgorithms' /etc/ssh/sshd_config && /usr/bin/sudo /usr/bin/sed -i.bak 's/^KexAlgorithms.*/KexAlgorithms diffie-hellman-group-exchange-sha256/' /etc/ssh/sshd_config || /usr/bin/sudo /usr/bin/sed -i.bak '/.*Ciphers and keying.*/a\'$'\n''KexAlgorithms diffie-hellman-group-exchange-sha256'$'\n' /etc/ssh/sshd_config

The SSH service must be restarted for changes to take effect.

Check Contents

If SSH is not being used, this is Not Applicable.

Inspect the "KexAlgorithms" configuration with the following command:
Note: The location of the "sshd_config" file may vary if a different daemon is in use.

/usr/bin/grep "^KexAlgorithms" /etc/ssh/sshd_config

KexAlgorithms diffie-hellman-group-exchange-sha256

If any algorithm other than "diffie-hellman-group-exchange-sha256" is listed or the "KexAlgorithms" keyword is missing, this is a finding.

Vulnerability Number

V-230769

Documentable

False

Rule Version

APPL-11-000056

Severity Override Guidance

If SSH is not being used, this is Not Applicable.

Inspect the "KexAlgorithms" configuration with the following command:
Note: The location of the "sshd_config" file may vary if a different daemon is in use.

/usr/bin/grep "^KexAlgorithms" /etc/ssh/sshd_config

KexAlgorithms diffie-hellman-group-exchange-sha256

If any algorithm other than "diffie-hellman-group-exchange-sha256" is listed or the "KexAlgorithms" keyword is missing, this is a finding.

Check Content Reference

M

Target Key

5246

Comments