Detections
Analytics

4.2.14 Ensure only strong MAC algorithms are used

Information

This variable limits the types of MAC algorithms that SSH can use during communication.

Notes:

 - Some organizations may have stricter requirements for approved MACs.
 - Ensure that MACs used are in compliance with site policy.
 - The only "strong" MACs currently FIPS 140-2 approved are:
 - hmac-sha2-256
 - hmac-sha2-512

MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of attention as a weak spot that can be exploited with expanded computing power. An attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the SSH tunnel and capture credentials and information.

Solution

Edit the /etc/ssh/sshd_config file and add/modify the MACs line to contain a comma separated list of the site approved MACs:

Example:

MACs [email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected],[email protected]

Note: First occurrence of a option takes precedence.

See Also

https://workbench.cisecurity.org/benchmarks/13007

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4, CSCv7|16.5

Plugin: Unix

Control ID: 9109209e214e60df0cd4e847219154558359ea092c33cb6a44f3886ff95bc6c7