Detections
Analytics
GEN005539-ESXI5-000113 - The SSH daemon must not allow compression or must only allow compression after successful authentication.
Information
If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Disable lock down mode. Enable the ESXi Shell. Execute the following command(s):# vi /etc/ssh/sshd_config
Add/modify the attribute line entry to the following (quotes for emphasis only):
'Compression no'
or
'Compression delayed'
Re-enable lock down mode.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip
Item Details
Audit Name: DISA VMWare ESXi 5.0 Server STIG v2r1
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Group-ID|V-39285, Rule-ID|SV-250603r798808_rule, STIG-ID|GEN005539-ESXI5-000113, STIG-Legacy|SV-51101, STIG-Legacy|V-39285, Vuln-ID|V-250603
Plugin: VMware
Control ID: 5f1260cd84aad5bc2b228d3f126d9910c741f85c23950eb9907e9769b53d7cc5