os_sshd_key_exchange_algorithm_configure.yaml

id: os_sshd_key_exchange_algorithm_configure
title: "Configure SSHD to Use Secure Key Exchange Algorithms"
discussion: |
  Unapproved mechanisms for authentication to the cryptographic module are not verified, and therefore cannot be relied upon to provide confidentiality or integrity, resulting in the compromise of DoD data.

  Operating systems using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules.

  The implementation of OpenSSH that is included with macOS does not utilize a FIPS 140-2 validated cryptographic module. While the listed Key Exchange Algorithms are FIPS 140-2 approved, the module implementing them has not been validated.

  By specifying a Key Exchange Algorithm list with the order of hashes being in a “strongest to weakest” orientation, the system will automatically attempt to use the strongest Key Exchange Algorithm for securing SSH connections.

  NOTE: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system.
check: |
  /usr/bin/grep -c "^KexAlgorithms diffie-hellman-group-exchange-sha256" /etc/ssh/sshd_config
result:
  integer: 1
fix: |
  [source,bash]
  ----
  /usr/bin/sed -i.bak 's/.*KexAlgorithms.*/KexAlgorithms diffie-hellman-group-exchange-sha256/' /etc/ssh/sshd_config; /bin/launchctl kickstart -k system/com.openssh.sshd
  ----
references:
  cce:
    - N/A
  cci: 
    - CCI-000803
    - CCI-000068
    - CCI-000087
    - CCI-003123
    - CCI-002890
  800-53r4: 
    - IA-7
    - AC-17(2)
    - MA-4(6)
  srg: 
    - SRG-OS-000033-GPOS-00014
    - SRG-OS-000120-GPOS-00061
    - SRG-OS-000125-GPOS-00065
    - SRG-OS-000250-GPOS-00093
    - SRG-OS-000393-GPOS-00173
    - SRG-OS-000394-GPOS-00174
  disa_stig: 
    - APPL-11-000056
  800-171r2:
    - N/A
macOS:
  - "11.0"
tags:
  - stig
severity: "medium"
mobileconfig: false
mobileconfig_info: