SV-227897r603266: The SSH client must be configured to not use CBC-based ciphers. | Solaris 10 X86 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The SSH client must be configured to not use CBC-based ciphers.

Description

Discussion Text

The Cipher-Block Chaining (CBC) mode of encryption as implemented in the SSHv2 protocol is vulnerable to chosen plain text attacks and must not be used.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366V-22462SV-26755

References

DPMS Target Solaris 10 X86 DISA DPMS Target Solaris 10 X86 4061

Checks

DISA STIG (Manual Reference)

Check the SSH client configuration for allowed ciphers.
# grep -i ciphers /etc/ssh/ssh_config | grep -v '^#' 
If no lines are returned, or the returned ciphers list contains any cipher ending with cbc, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.solaris11:def:320
# The SSH client must be configured to not use CBC-based ciphers.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# Check ssh_config for CBC ciphers
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  ! ( grep -Pq '^[ \t]*[Cc][Ii][Pp][Hh][Ee][Rr][Ss][ \t]+[-,a-z0-9]+-cbc' '/etc/ssh/ssh_config' &>/dev/null )
}
# Check for Cipher keyword in file
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  grep -Pq '^[ \t]*[Cc][Ii][Pp][Hh][Ee][Rr][Ss][ \t]' '/etc/ssh/ssh_config' &>/dev/null
}

if ! ( test_1 && test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Remediation

Edit /etc/ssh/ssh_config and add or edit the "Ciphers" line.  Only include ciphers that start with "3des" or "aes" and do not contain "cbc".  For the list of available ciphers for the particular version of your software, consult the ssh_config manpage.