Detections
Analytics

1.6.2 Ensure system wide crypto policy is not set in sshd configuration

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

System-wide Crypto policy can be over-ridden or opted out of for openSSH

Over-riding or opting out of the system-wide crypto policy could allow for the use of less secure Ciphers, MACs, KexAlgorithms and GSSAPIKexAlgorithm

Note: If changes to the system-wide crypto policy are required to meet local site policy for the openSSH server, these changes should be done with a sub-policy assigned to the system-wide crypto policy. For additional information see the CRYPTO-POLICIES(7) man page

Solution

Run the following commands:

# sed -ri "s/^\s*(CRYPTO_POLICY\s*=.*)$/# \1/" /etc/sysconfig/sshd

# systemctl reload sshd

See Also

https://workbench.cisecurity.org/benchmarks/18211

Item Details

References: CSCv7|14.4

Plugin: Unix

Control ID: 7b7aa169ab6bfaf33a8909b8c99b045e3e5d8dcabb8733ec5712254648c87ab6