STIGQter: STIG Summary: VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Sep 2018:

The SLES for vRealize must enforce SSHv2 for network access to non-privileged accounts.

DISA Rule

SV-99229r1_rule

Vulnerability Number

V-88579

Group Title

SRG-OS-000113-GPOS-00058

Rule Version

VROM-SL-000695

Severity

CAT II

CCI(s)

• CCI-001942 - The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.

Weight

10

Fix Recommendation

Configure SLES for vRealize to enforce SSHv2 for network access to non-privileged accounts by running the following commands:

# sed -i 's/^.*\bProtocol\b.*$/Protocol 2/' /etc/ssh/sshd_config

Restart the ssh service.

# service sshd restart

Check Contents

Verify that SLES for vRealize enforces SSHv2 for network access to privileged accounts by running the following command:

Replace [ADDRESS] in the following command with the correct IP address based on the current system configuration.

# ssh -1 [ADDRESS]

An example of the command usage is as follows:
# ssh -1 localhost

The output must be one of the following items:

Protocol major versions differ: 1 vs. 2

OR

Protocol 1 not allowed in the FIPS mode.

If it does not, this is a finding.

OR

Verify that the ssh is configured to enforce SSHv2 for network access to privileged accounts by running the following command:

# grep Protocol /etc/ssh/sshd_config

If the result is not "Protocol 2", this is a finding.

Vulnerability Number

V-88579

Documentable

False

Rule Version

VROM-SL-000695

Severity Override Guidance

Verify that SLES for vRealize enforces SSHv2 for network access to privileged accounts by running the following command:

Replace [ADDRESS] in the following command with the correct IP address based on the current system configuration.

# ssh -1 [ADDRESS]

An example of the command usage is as follows:
# ssh -1 localhost

The output must be one of the following items:

Protocol major versions differ: 1 vs. 2

OR

Protocol 1 not allowed in the FIPS mode.

If it does not, this is a finding.

OR

Verify that the ssh is configured to enforce SSHv2 for network access to privileged accounts by running the following command:

# grep Protocol /etc/ssh/sshd_config

If the result is not "Protocol 2", this is a finding.

Check Content Reference

M

Target Key

3461

Comments