STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

The TOSS SSH daemon must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.

DISA Rule

SV-252926r991554_rule

Vulnerability Number

V-252926

Group Title

SRG-OS-000250-GPOS-00093

Rule Version

TOSS-04-010160

Severity

CAT II

CCI(s)

• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.

Weight

10

Fix Recommendation

Configure the TOSS SSH daemon to use only MACs employing FIPS 140-2-approved algorithms.

Update the "/etc/crypto-policies/back-ends/openssh.config"
and "/etc/crypto-policies/back-ends/opensshserver.config" files to include these MACs employing FIPS 140-2-approved algorithms:

/etc/crypto-policies/back-ends/openssh.config:MACs hmac-sha2-512,hmac-sha2-256
/etc/crypto-policies/back-ends/opensshserver.config:-oMACs=hmac-sha2-512,hmac-sha2-256'
/etc/crypto-policies/back-ends/opensshserver.config:-oMACs=hmac-sha2-512,hmac-sha2-256'

A reboot is required for the changes to take effect.

Check Contents

Verify the SSH daemon is configured to use only MACs employing FIPS 140-2-approved algorithms:

Check that the MACs in the back-end configurations are FIPS 140-2-approved algorithms with the following command:

$ sudo grep -i macs /etc/crypto-policies/back-ends/openssh.config /etc/crypto-policies/back-ends/opensshserver.config

/etc/crypto-policies/back-ends/openssh.config:MACs hmac-sha2-512,hmac-sha2-256
/etc/crypto-policies/back-ends/opensshserver.config:-oMACs=hmac-sha2-512,hmac-sha2-256'
/etc/crypto-policies/back-ends/opensshserver.config:-oMACs=hmac-sha2-512,hmac-sha2-256'

If the MAC entries in the "openssh.config" and "opensshserver.config" files have any hashes other than "hmac-sha2-512" and "hmac-sha2-256", the order differs from the example above, if they are missing, or commented out, this is a finding.

Vulnerability Number

V-252926

Documentable

False

Rule Version

TOSS-04-010160

Severity Override Guidance

Verify the SSH daemon is configured to use only MACs employing FIPS 140-2-approved algorithms:

Check that the MACs in the back-end configurations are FIPS 140-2-approved algorithms with the following command:

$ sudo grep -i macs /etc/crypto-policies/back-ends/openssh.config /etc/crypto-policies/back-ends/opensshserver.config

/etc/crypto-policies/back-ends/openssh.config:MACs hmac-sha2-512,hmac-sha2-256
/etc/crypto-policies/back-ends/opensshserver.config:-oMACs=hmac-sha2-512,hmac-sha2-256'
/etc/crypto-policies/back-ends/opensshserver.config:-oMACs=hmac-sha2-512,hmac-sha2-256'

If the MAC entries in the "openssh.config" and "opensshserver.config" files have any hashes other than "hmac-sha2-512" and "hmac-sha2-256", the order differs from the example above, if they are missing, or commented out, this is a finding.

Check Content Reference

M

Target Key

5469