Detections
Analytics

4.2.14 Ensure system-wide crypto policy is not over-ridden

Information

System-wide Crypto policy can be over-ridden or opted out of for openSSH

Over-riding or opting out of the system-wide crypto policy could allow for the use of less secure Ciphers, MACs, KexAlgorithms and GSSAPIKexAlgorithm

Solution

Run the following commands:

# sed -ri "s/^\s*(CRYPTO_POLICY\s*=.*)$/# \1/" /etc/sysconfig/sshd /etc/ssh/sshd_config.d/*.conf

# systemctl reload sshd

See Also

https://workbench.cisecurity.org/benchmarks/12705

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17, 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: Unix

Control ID: e2c1279656b7cc1d604bb35854fcbf8abd24c7f8c33d4bb11e6e0654d001781b