Detections
Analytics

1.279 OL09-00-002355

Information

OL 9 SSH daemon must not allow compression or must only allow compression after successful authentication.

GROUP ID: V-271717
RULE ID: SV-271717r1091863

If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.

Solution

Configure the SSH daemon to not allow compression.

Add the following line to "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d" or uncomment the line and set the value to "delayed" or "no":

Compression no

The SSH service must be restarted for changes to take effect:

$ sudo systemctl restart sshd.service

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-271717r1091863_rule, STIG-ID|OL09-00-002355, Vuln-ID|V-271717

Plugin: Unix

Control ID: acca4dac5fa1916fc112685af1a62b4f24cf6b95f5fe2cc7b3da8658b7a36ffa