[PATCH 2/3] removed text referring to earlier issues with CBC ciphers

David Smith dsmith at eclipse.ncsc.mil
Wed Oct 31 11:40:13 UTC 2012


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/services/ssh.xml |    7 +------
 1 files changed, 1 insertions(+), 6 deletions(-)

diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index e64eddc..9320999 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -349,12 +349,7 @@ The following line in <tt>/etc/ssh/sshd_config</tt>
 demonstrates use of FIPS-approved ciphers:
 <pre>Ciphers aes128-ctr,aes192-ctr,aes256-ctr, aes128-cbc, 3des-cbc, aes192-cbc, aes256-cbc</pre>
 The man page <tt>sshd_config(5)</tt> contains a list of supported ciphers.
-Note that older or less capable versions of SSH client or server software
-may still be found on systems such as networking equipment, and these
-may not support CTR mode. This may become an issue if, for example,
-these systems need to retrieve files from your SSH server using SFTP.
-TODO: Need to investigate current status of this. Earlier issues with
-CBC were supposed to be fixed.</description>
+</description>
 <ocil clause="that is not the case">
 Only FIPS-approved ciphers should be used.  To verify that only FIPS-approved 
 ciphers are in use, run the following command:
-- 
1.7.1



More information about the scap-security-guide mailing list