Detections
Analytics
5.1.5 Ensure sshd Ciphers are configured
Information
Secure Shell (SSH) ciphers are encryption algorithms used by the SSH protocol to secure data transmitted between a client and a server. They protect the privacy and integrity of the connection, using symmetric encryption to encrypt data after a secure session is established. During connection setup, the client and server negotiate to select the strongest available cipher that both support, ensuring the connection is as secure as possibleMore information about the openSSH server configuration is available in the "Configure SSH Server" section overview.
Weak ciphers that are used for authentication to the cryptographic module cannot be relied upon to provide confidentiality or integrity, and system data may be compromised.
Solution
The ciphers available to the SSH server are governed by the system-wide crypto policy. Disable the weak ciphers by configuring the system-wide crypto policy as described in the "Configure system wide crypto policy" section.- IF - CVE-2023-48795 (Terrapin) has not been reviewed and addressed, chacha20-poly1305 should also be disabled through the system-wide crypto policy.
Once the crypto policy has been updated, reload the SSH daemon:
# systemctl reload-or-restart sshd
Impact:
A too restrictive list of ciphers can lead to the "no matching cipher found" error during an SSH connection. This error indicates that the SSH client and server are unable to agree on a common cipher to use for the secure communication. This typically occurs due to a mismatch in supported ciphers or when older, less secure ciphers are disabled on one side but still expected by the other.
See Also
Item Details
Audit Name: CIS Oracle Linux 9 v3.0.0 L1 Server
Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4
Plugin: Unix
Control ID: 650cbbfa5b93e4154c4a5980d88d838ed10e0d7dc2e8bdff53c911045a520094