[PATCH] Fix Ciphers check of sshd config

Andrew Gilmore agilmore2 at gmail.com
Wed Jul 10 17:16:21 UTC 2013


The text in the guide suggests that AES and 3DES ciphers are allowed in CBC
and CTR versions.

"Limit the ciphers to those algorithms which are FIPS-approved. Counter
(CTR) mode is also preferred over cipher-block chaining (CBC) mode. The
following line in /etc/ssh/sshd_config demonstrates use of FIPS-approved
ciphers:

Ciphers
aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc"


However, the test has the old CTR only list.

Patch below.
This fixes one of the annoying false-positives that occur when I run the
SSG against my systems which have been hardened according to the guide.

Andrew Gilmore

Signed-off-by: Andrew Gilmore <agilmore2 at gmail.com>
---
diff --git a/RHEL6/input/checks/sshd_use_approved_ciphers.xml
b/RHEL6/input/checks/sshd_use_approved_ciphers.xml
index 267fe93..1807d56 100644
--- a/RHEL6/input/checks/sshd_use_approved_ciphers.xml
+++ b/RHEL6/input/checks/sshd_use_approved_ciphers.xml
@@ -21,7 +21,7 @@
   <ind:textfilecontent54_object id="obj_20251" version="1">
     <ind:path>/etc/ssh</ind:path>
     <ind:filename>sshd_config</ind:filename>
-    <ind:pattern operation="pattern
match">^\s*Ciphers\s*aes128-ctr,aes192-ctr,aes256-ctr\s*$</ind:pattern>
+    <ind:pattern operation="pattern
match">^\s*Ciphers\s*aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc\s*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 </def-group>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130710/9b082b32/attachment.html>


More information about the scap-security-guide mailing list