Details

Approved algorithms should impart some level of confidence in their implementation. These are also required for compliance.

Solution

Limit the ciphers to algorithms that are FIPS approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode.

Add or correct the following line in ‘/etc/ssh/sshd_config’:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Unix.

References

• 800-53|SC-13
• CAT|II
• CCI|CCI-002450
• Rule-ID|SV-239331r674922_rule
• STIG-ID|ESXI-67-100010
• Vuln-ID|V-239331

Source

• Tenable.com/audits