Detections
Analytics
APPL-12-000059 - The macOS system must implement approved Key Exchange Algorithms within the SSH client configuration.
Information
Operating systems using encryption are required to use FIPS-compliant mechanisms for authenticating to macOS.For OpenSSH to utilize the Apple Corecrypto FIPS-validated algorithms, a specific configuration is required to leverage the shim implemented by macOS to bypass the non-FIPS validated LibreSSL crypto module packaged with OpenSSH. Information regarding this configuration can be found in the manual page 'apple_ssh_and_fips'.
Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00176
Solution
Configure the macOS system to use approved SSH Key Exchange Algorithms by creating a plain text file in the /private/etc/ssh/ssh_config.d/ directory containing the following:KexAlgorithms ecdh-sha2-nistp256
The SSH service must be restarted for changes to take effect.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_macOS_12_V1R9_STIG.zip
Item Details
Audit Name: DISA STIG Apple macOS 12 v1r9
Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, MAINTENANCE
References: 800-53|AC-17(2), 800-53|IA-7, 800-53|MA-4(6), 800-53|MA-4c., CAT|I, CCI|CCI-000068, CCI|CCI-000803, CCI|CCI-000877, CCI|CCI-001453, CCI|CCI-002890, CCI|CCI-003123, Rule-ID|SV-257775r958408_rule, STIG-ID|APPL-12-000059, Vuln-ID|V-257775
Plugin: Unix
Control ID: 425d9047d22cef2741e26a0b19fb1d8fb9c6e59512d39bb0fe568b04ad497313