<div dir="ltr">The text in the guide suggests that AES and 3DES ciphers are allowed in CBC and CTR versions.<div><br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div>"Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. The following line in /etc/ssh/sshd_config demonstrates use of FIPS-approved ciphers:</div>
<div><br></div><div>Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc"</div></blockquote><div><span style="color:rgb(0,0,0);font-family:sans-serif;font-size:medium"></span></div><div>
<br></div><div>However, the test has the old CTR only list.</div><div><div><br></div><div>Patch below.<br></div><div></div></div><div>This fixes one of the annoying false-positives that occur when I run the SSG against my systems which have been hardened according to the guide.</div>
<div><br>Andrew Gilmore<br><br></div><div>Signed-off-by: Andrew Gilmore <<a href="mailto:agilmore2@gmail.com">agilmore2@gmail.com</a>><br>---</div><div><div>diff --git a/RHEL6/input/checks/sshd_use_approved_ciphers.xml b/RHEL6/input/checks/sshd_use_approved_ciphers.xml</div>
<div>index 267fe93..1807d56 100644</div><div>--- a/RHEL6/input/checks/sshd_use_approved_ciphers.xml</div><div>+++ b/RHEL6/input/checks/sshd_use_approved_ciphers.xml</div><div>@@ -21,7 +21,7 @@</div><div> <ind:textfilecontent54_object id="obj_20251" version="1"></div>
<div> <ind:path>/etc/ssh</ind:path></div><div> <ind:filename>sshd_config</ind:filename></div><div>- <ind:pattern operation="pattern match">^\s*Ciphers\s*aes128-ctr,aes192-ctr,aes256-ctr\s*$</ind:pattern></div>
<div>+ <ind:pattern operation="pattern match">^\s*Ciphers\s*aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc\s*$</ind:pattern></div><div> <ind:instance datatype="int">1</ind:instance> </div>
<div> </ind:textfilecontent54_object></div><div> </def-group></div><div><br></div></div></div>