Detections
Analytics

1.157 ALMA-09-020370

Information

AlmaLinux OS 9 SSH daemon must not allow compression or must only allow compression after successful authentication.

GROUP ID: V-269260
RULE ID: SV-269260r1050142

If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.

Solution

Configure the SSH daemon to not allow compression.

Add the following line to "/etc/ssh/sshd_config", or uncomment the line and set the value to "delayed" or preferably "no":

Compression no

Alternatively, add the setting to an include file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file:

$ echo 'Compression no' > /etc/ssh/sshd_config.d/40-compression.conf

Restart the SSH daemon for the settings to take effect:

$ systemctl restart sshd.service

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-269260r1050142_rule, STIG-ID|ALMA-09-020370, Vuln-ID|V-269260

Plugin: Unix

Control ID: 3707f24bef19d0f0a809eeb716e03f783a2ca09dd5021f15b535d936e9544153