Detections
Analytics

1.65 UBTU-22-255060

Information

The operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.

GROUP ID: V-260533
RULE ID: SV-260533r958408

Without cryptographic integrity protections provided by FIPS-validated cryptographic algorithms, information can be viewed and altered by unauthorized users without detection.

The system will attempt to use the first algorithm presented by the client that matches the server list. Listing the values "strongest to weakest" is a method to ensure the use of the strongest algorithm available to secure the SSH connection.

Solution

Configure the SSH server to use only FIPS-validated key exchange algorithms.

Add or modify the following line in the "/etc/ssh/sshd_config" file:

KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256

Restart the SSH server for changes to take effect:

$ sudo systemctl restart sshd.service

See Also

https://workbench.cisecurity.org/benchmarks/22168

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-17(2), CAT|II, CCI|CCI-000068, CSCv7|14.4, Rule-ID|SV-260533r958408_rule, STIG-ID|UBTU-22-255060, Vuln-ID|V-260533

Plugin: Unix

Control ID: edb3598b20e3f7b5e43b7d4d613f531870ef1acd805bc8d7d084c14a44379eb2