I need to look through the SCAP code but, since the order of ciphers is
unimportant on the daemon side, wouldn't you want the check side of this to
be a regex such that people can use the same cipher setting for both
ssh_config and sshd_config?
I would modify the order of the remediation statement in this patch to
match the strong -> weak order as well as a hint to the local admin.
I tend to list from strongest to weakest for ssh_config and just re-use the
string in sshd_config for consistency.
There should be a check (I apologize if there is and I just didn't check
enough) for the Ciphers setting in ssh_config as well to order the ciphers
from strongest to weakest since order matters in the client file.
Yes, I know that the client file can be overridden by the user but, since
most users don't do that, it's a good idea to set it appropriately.
Thanks,
Trevor
On Mon, Sep 9, 2013 at 8:47 AM, Jeffrey Blank <blank(a)eclipse.ncsc.mil>wrote:
In the glorious future, we might want to rewrite the check and the
guidance to indicate which cipher modes and key lengths we like, and
then only flag things if others are included. But this looks fine for
now.
How these are "approved" is quite a mystery as well, but no biggie, we
can work in refs later.
On Sat, Sep 7, 2013 at 3:22 PM, Shawn Wells <shawn.d.wells(a)gmail.com>
wrote:
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan(a)onyxpoint.com
-- This account not approved for unencrypted proprietary information --