APPL-13-000054 - The macOS system must implement approved ciphers within the SSH server configuration to protect the confidentiality of SSH connections.

Information

Operating systems using encryption are required to use FIPS-compliant mechanisms for authenticating to macOS.

For OpenSSH to utilize the Apple Corecrypto FIPS-validated algorithms, a specific configuration is required to leverage the shim implemented by macOS to bypass the non-FIPS validated LibreSSL crypto module packaged with OpenSSH. Information regarding this configuration can be found in the manual page 'apple_ssh_and_fips'.

Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174

Solution

Configure the macOS system to use approved SSH ciphers by creating a plain text file in the /private/etc/ssh/sshd_config.d/ directory containing the following:

Ciphers [email protected]

The SSH service must be restarted for changes to take effect.

Item Details

Audit Name: DISA STIG Apple macOS 13 v1r5

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, MAINTENANCE

Plugin: Unix

Control ID: 43c07631038985813f68937e97ad6a995018064cab7c13b45c5a1f50f509b62c

Detections

Analytics

APPL-13-000054 - The macOS system must implement approved ciphers within the SSH server configuration to protect the confidentiality of SSH connections.

Information

Solution

See Also

Item Details