SV-220055r854395: The SSH daemon must be configured to only use the SSHv2 protocol. | Solaris 10 SPARC STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The SSH daemon must be configured to only use the SSHv2 protocol.

Description

Discussion Text

SSHv1 is not a DoD-approved protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001941CCE-4726-6SV-39817V-4295

References

DPMS Target Solaris 10 SPARC DISA DPMS Target Solaris 10 SPARC 4060

Checks

DISA STIG (Manual Reference)

Check the SSH daemon configuration for allowed protocol versions. 

# grep -i protocol /etc/ssh/sshd_config | grep -v '^#' 

If the variables Protocol 2,1 or Protocol 1 are defined on a line without a leading comment, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Remediation