Detections
Analytics

5.1.17 Ensure sshd MACs are configured

Information

This variable limits the types of MAC algorithms that SSH can use during communication.

More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of attention as a weak spot that can be exploited with expanded computing power. An attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the SSH tunnel and capture credentials and information.

Solution

Create or edit a *.conf file in the /etc/ssh/sshd_config.d/ and add/modify the MACs line to contain a comma separated list of the site unapproved (weak) MACs preceded with a - above any Include entries:

Example:

MACs -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected]

- IF - CVE-2023-48795 has not been reviewed and addressed, the following etm MACs should be added to the exclude list: [email protected] mailto:[email protected],[email protected] mailto:[email protected],[email protected] mailto:[email protected]

Run the following command to apply the configuration change to the running sshd daemon without interrupting active sessions:

# systemctl reload sshd

Impact:

Incorrectly configured or an overly restrictive list of MACs could lead to a "no matching MAC" error during an SSH connection. This means the client and server have no overlapping MAC algorithms which typically occurs due to a mismatch in supported MACs.

See Also

https://workbench.cisecurity.org/benchmarks/27798

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4, CSCv7|16.5

Plugin: Unix

Control ID: 7cf6df981c7a1934a2d2302f2427082b9a2bc9f4cbd4c24da65189435d44c8e4