os_ssh_fips_140_ciphers.yaml

id: os_ssh_fips_140_ciphers
title: "Limit SSH to FIPS 140 Validated Ciphers"
discussion: |
  SSH _MUST_ be configured to limit the ciphers to algorithms that are FIPS 140 validated.

  FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meet federal requirements.

  Operating systems utilizing encryption _MUST_ use FIPS validated mechanisms for authenticating to cryptographic modules. 

  NOTE: /etc/ssh/ssh_config will be automatically modified to its original state following any update or major upgrade to the operating system.
check: |
  /usr/bin/grep -c "^Ciphers aes256-ctr,aes192-ctr,aes128-ctr" /etc/ssh/ssh_config
result:
  integer: 1
fix: |
  [source,bash]
  ----
  /usr/bin/grep -q '^Ciphers' /etc/ssh/ssh_config && /usr/bin/sed -i.bak  's/.^Ciphers.*/Ciphers aes256-ctr,aes192-ctr,aes128-ctr/' /etc/ssh/ssh_config || /bin/echo 'Ciphers aes256-ctr,aes192-ctr,aes128-ctr' >> /etc/ssh/ssh_config
  ----
references:
  cce:
    - CCE-85382-0
  cci: 
    - N/A
  800-53r4: 
    - AC-17(2)
    - IA-7
    - SC-8(1)
    - SC-13
  srg: 
    - N/A
  disa_stig: 
    - N/A
  800-171r2:
    - 3.1.13
    - 3.13.8
    - 3.13.11
macOS:
  - "11.0"
tags:
  - 800-171
  - cnssi-1253
  - 800-53r4_low
  - 800-53r4_moderate
  - 800-53r4_high
mobileconfig: false
mobileconfig_info: