IT Best Practices Tip: nist_V-38617

Severity: medium

Short Description

The SSH daemon must be configured to use only FIPS 140-2 approved ciphers.

Long Description

Approved algorithms should impart some level of confidence in their implementation. These are also required for compliance.

How to Check Correct Configuration

Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command:

# grep Ciphers /etc/ssh/sshd_config

The output should contain only those ciphers which are FIPS-approved, namely, the AES and 3DES ciphers.
If that is not the case, this is a finding.

How to Fix

Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. The following line in "/etc/ssh/sshd_config" demonstrates use of FIPS-approved ciphers:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

The man page "sshd_config(5)" contains a list of supported ciphers.