Detections
Analytics

6.5.1 Host SSH daemon, if enabled, must use FIPS 140-2/140-3 validated ciphers

Information

For enhanced security, if the SSH daemon is enabled on the host, it must utilize FIPS 140-2/140-3 validated ciphers. This requirement ensures the encryption standards are robust and compliant with regulatory mandates.

Employing FIPS validated ciphers is vital for maintaining a high level of security and integrity in communications. It aligns with industry best practices and regulatory compliance requirements, ensuring secure SSH connections.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To remediate this recommendation, configure the SSH daemon to use only the approved FIPS-capable cipher list supported by the installed ESXi build. Validate access from approved administration clients before deploying broadly.

Impact:

There is no functional impact noted for this control; however, it significantly improves the security posture by enforcing the use of strong, validated encryption ciphers for SSH communications.

See Also

https://workbench.cisecurity.org/benchmarks/28124

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|11.4

Plugin: Unix

Control ID: 4cfee8cb4eb505f6e873fc2e4211158732632e21a183f680a879389e40f0ecc6