Detections
Analytics

1.19 APPL-14-000054

Information

The macOS system must limit SSHD to FIPS-compliant connections.

GROUP ID: V-259438RULE ID: SV-259438r958408

If SSHD is enabled then it must be configured to limit the Ciphers, HostbasedAcceptedAlgorithms, HostKeyAlgorithms, KexAlgorithms, MACs, PubkeyAcceptedAlgorithms, CASignatureAlgorithms to algorithms that are FIPS 140 validated.

FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meet federal requirements.

Operating systems utilizing encryption must use FIPS validated mechanisms for authenticating to cryptographic modules.

Note: For more information on FIPS compliance with the version of SSHD included in the macOS, the manual page apple_ssh_and_fips has additional information.

Satisfies: SRG-OS-000033-GPOS-00014,SRG-OS-000120-GPOS-00061,SRG-OS-000250-GPOS-00093,SRG-OS-000393-GPOS-00173,SRG-OS-000394-GPOS-00174,SRG-OS-000396-GPOS-00176,SRG-OS-000424-GPOS-00188,SRG-OS-000478-GPOS-00223

Solution

Configure the macOS system to limit SSHD to FIPS-compliant connections with the following command:

fips_sshd_config="Ciphers [email protected] mailto:[email protected] HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256, [email protected] mailto:[email protected] HostKeyAlgorithms ecdsa-sha2-nistp256, [email protected] mailto:[email protected] KexAlgorithms ecdh-sha2-nistp256MACs hmac-sha2-256PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256, [email protected] mailto:[email protected] CASignatureAlgorithms ecdsa-sha2-nistp256"/bin/echo "${fips_sshd_config}" > /etc/ssh/sshd_config.d/fips_sshd_config

See Also

https://workbench.cisecurity.org/benchmarks/24070

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, MAINTENANCE, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-7, 800-53|MA-4(6), 800-53|SC-8(1), 800-53|SC-13, CAT|I, CCI|CCI-000068, CCI|CCI-000803, CCI|CCI-001453, CCI|CCI-002421, CCI|CCI-002450, CCI|CCI-002890, CCI|CCI-003123, Rule-ID|SV-259438r958408_rule, STIG-ID|APPL-14-000054, Vuln-ID|V-259438

Plugin: Unix

Control ID: 8c34a555ca7111c68c1ae033948af00bbf41b80fc568d731e3401ac7c85094f4