STIGQter: STIG Summary: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

Ubuntu 24.04 LTS SSH server must be configured to use only FIPS 140-3 validated key exchange algorithms.

DISA Rule

SV-270669r1134804_rule

Vulnerability Number

V-270669

Group Title

SRG-OS-000033-GPOS-00014

Rule Version

UBTU-24-100840

Severity

CAT II

CCI(s)

CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.

Weight

Fix Recommendation

Configure the SSH daemon to use only FIPS-validated key exchange algorithms by adding or modifying the following line in "/etc/ssh/sshd_config":

KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256

Restart the "sshd" service for changes to take effect:

$ sudo systemctl restart sshd

Check Contents

Verify that the SSH daemon is configured to use only FIPS-validated key exchange algorithms with the following command:

$ sudo grep -ir kexalgorithms /etc/ssh/sshd_config*
KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256

If "KexAlgorithms" does not contain only the algorithms "ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256", is commented out, or is missing, this is a finding.

Vulnerability Number

V-270669

Documentable

False

Rule Version

UBTU-24-100840

Severity Override Guidance

Check Content Reference

Target Key

5673