STIGQter STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 SSH client must be configured to use only encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.

DISA Rule

SV-269113r1184081_rule

Vulnerability Number

V-269113

Group Title

SRG-OS-000250-GPOS-00093

Rule Version

ALMA-09-002990

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure the AlmaLinux OS 9 SSH client to use only ciphers employing FIPS 140-3-approved algorithms.

Reinstall crypto-policies with the following command:

$ sudo dnf -y reinstall crypto-policies

Set the crypto-policy to FIPS with the following command:

$ sudo update-crypto-policies --set FIPS

Setting system policy to FIPS

Check Contents

Verify the SSH client is configured to use only ciphers employing FIPS 140-3-approved algorithms with the following command:

$ grep -i Ciphers /etc/crypto-policies/back-ends/openssh.config

Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr

If the cipher entries in the "openssh.config" file have any ciphers other than "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr", they are missing, or commented out, this is a finding.

Vulnerability Number

V-269113

Documentable

False

Rule Version

ALMA-09-002990

Severity Override Guidance

Verify the SSH client is configured to use only ciphers employing FIPS 140-3-approved algorithms with the following command:

$ grep -i Ciphers /etc/crypto-policies/back-ends/openssh.config

Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr

If the cipher entries in the "openssh.config" file have any ciphers other than "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr", they are missing, or commented out, this is a finding.

Check Content Reference

M

Target Key

5664