Detections
Analytics

5.1.15 Ensure sshd MACs are configured

Information

This variable limits the types of MAC algorithms that SSH can use during communication.

Notes:

 - Some organizations may have stricter requirements for approved MACs.
 - Ensure that MACs used are in compliance with site policy.
 - The only "strong" MACs currently FIPS 140 approved are:

 - HMAC-SHA1
 - HMAC-SHA2-256
 - HMAC-SHA2-384
 - HMAC-SHA2-512

MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of attention as a weak spot that can be exploited with expanded computing power. An attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the SSH tunnel and capture credentials and information.

Solution

Edit the /etc/ssh/sshd_config file and add/modify the MACs line to contain a comma separated list of the site unapproved (weak) MACs preceded with a - above any Include entries:

Example:

MACs -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected]

- IF - CVE-2023-48795 has not been reviewed and addressed, the following etm MACs should be added to the exclude list: [email protected] mailto:[email protected],[email protected] mailto:[email protected],[email protected] mailto:[email protected]

Note: First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.

See Also

https://workbench.cisecurity.org/benchmarks/24330

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4, CSCv7|16.5, STIG-ID|CVE-2023-48795

Plugin: Unix

Control ID: 6adcbfcf4dc2468ecac98c23b7f27c8b2f86486a0961515f01ccd5a2d876a744