I need to look through the SCAP code but, since the order of ciphers is unimportant on the daemon side, wouldn't you want the check side of this to be a regex such that people can use the same cipher setting for both ssh_config and sshd_config?

I would modify the order of the remediation statement in this patch to match the strong -> weak order as well as a hint to the local admin.

I tend to list from strongest to weakest for ssh_config and just re-use the string in sshd_config for consistency.

There should be a check (I apologize if there is and I just didn't check enough) for the Ciphers setting in ssh_config as well to order the ciphers from strongest to weakest since order matters in the client file.

Yes, I know that the client file can be overridden by the user but, since most users don't do that, it's a good idea to set it appropriately.

Thanks,

Trevor


On Mon, Sep 9, 2013 at 8:47 AM, Jeffrey Blank <blank@eclipse.ncsc.mil> wrote:
In the glorious future, we might want to rewrite the check and the
guidance to indicate which cipher modes and key lengths we like, and
then only flag things if others are included.  But this looks fine for
now.

How these are "approved" is quite a mystery as well, but no biggie, we
can work in refs later.

On Sat, Sep 7, 2013 at 3:22 PM, Shawn Wells <shawn.d.wells@gmail.com> wrote:
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide@lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan@onyxpoint.com

-- This account not approved for unencrypted proprietary information --