STIGQter: STIG Summary: Oracle Linux 8 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

The OL 8 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.

DISA Rule

SV-283457r1188515_rule

Vulnerability Number

V-283457

Group Title

SRG-OS-000250-GPOS-00093

Rule Version

OL08-00-010290

Severity

CAT I

CCI(s)

CCI-000877 - Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.
CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.

Weight

Fix Recommendation

Configure the OL 8 SSH server to use only MACs employing FIPS 140-3-approved algorithms.

Reinstall crypto-policies with the following command:

$ sudo dnf -y reinstall crypto-policies

Set the crypto-policy to FIPS with the following command:

$ sudo update-crypto-policies --set FIPS

Setting system policy to FIPS

Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

Check Contents

Verify the OL 8 SSH server is configured to use only MACs employing FIPS 140-3-approved algorithms.

To verify the MACs in the systemwide SSH configuration file, use the following command:

$ sudo grep -i MACs /etc/crypto-policies/back-ends/opensshserver.config

-oMACs=hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256

If the MACs entries in the "opensshserver.config" file have any hashes other than "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256", or they are missing or commented out, this is a finding.

Vulnerability Number

V-283457

Documentable

False

Rule Version

OL08-00-010290

Severity Override Guidance

Check Content Reference

Target Key

5416