STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Mar 2026:

TOSS 5 must implement DOD or other applicable U.S. Government agency-approved encryption ciphers to protect the confidentiality of SSH server connections.

DISA Rule

SV-282524r1201364_rule

Vulnerability Number

V-282524

Group Title

SRG-OS-000250-GPOS-00093

Rule Version

TOSS-05-000243

Severity

CAT II

CCI(s)

CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.

Weight

Fix Recommendation

Configure the TOSS 5 SSH client to only use ciphers employing FIPS 140-3-approved algorithms by updating the "/etc/crypto-policies/back-ends/openssh.config" file with the following line:

Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr

Restart the system for the changes to take effect.

Check Contents

Verify the SSH client is configured to use only ciphers employing FIPS 140-3-approved algorithms using the following command:

$ sudo grep -i ciphers /etc/crypto-policies/back-ends/openssh.config

Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr

If the cipher entries in the "openssh.config" file have any ciphers other than "aes256-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes256-ctr,aes128-gcm@openssh.com", "aes128-ctr"; the order differs from the example above; they are missing; or commented out, this is a finding.

Vulnerability Number

V-282524

Documentable

False

Rule Version

TOSS-05-000243

Severity Override Guidance

Check Content Reference

Target Key

5738