[PATCH 2/3] removed text referring to earlier issues with CBC ciphers
David Smith
dsmith at eclipse.ncsc.mil
Wed Oct 31 11:40:13 UTC 2012
Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
RHEL6/input/services/ssh.xml | 7 +------
1 files changed, 1 insertions(+), 6 deletions(-)
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index e64eddc..9320999 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -349,12 +349,7 @@ The following line in <tt>/etc/ssh/sshd_config</tt>
demonstrates use of FIPS-approved ciphers:
<pre>Ciphers aes128-ctr,aes192-ctr,aes256-ctr, aes128-cbc, 3des-cbc, aes192-cbc, aes256-cbc</pre>
The man page <tt>sshd_config(5)</tt> contains a list of supported ciphers.
-Note that older or less capable versions of SSH client or server software
-may still be found on systems such as networking equipment, and these
-may not support CTR mode. This may become an issue if, for example,
-these systems need to retrieve files from your SSH server using SFTP.
-TODO: Need to investigate current status of this. Earlier issues with
-CBC were supposed to be fixed.</description>
+</description>
<ocil clause="that is not the case">
Only FIPS-approved ciphers should be used. To verify that only FIPS-approved
ciphers are in use, run the following command:
--
1.7.1
More information about the scap-security-guide
mailing list