V-285672

Discussion

SSH is commonly used to administer Harvester Government hosts and provides access to privileged operating system functions. Weak cryptographic algorithms can expose SSH communications to compromise through cryptographic attacks, potentially resulting in the disclosure or modification of sensitive information. In addition, unattended SSH sessions present a risk of unauthorized access if an authenticated session remains active after the administrator is no longer present. Configuring approved key exchange algorithms, message authentication codes (MACs), and encryption ciphers, while enforcing inactivity timeouts, helps protect the confidentiality and integrity of remote management sessions and reduces the risk associated with abandoned authenticated connections. Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109

Check Content

Verify Harvester Government SSH daemon is configured to use approved cryptographic algorithms and terminate inactive SSH sessions.

1. Access Harvester Government using a privileged account and verify the SSH STIG configuration file exists and is protected:

stat -c "%n %a %U %G" /etc/ssh/sshd_config.d/stig.conf

2. Verify the output returns:

/etc/ssh/sshd_config.d/stig.conf 600 root root

If the file does not exist, is not owned by root, or permissions are more permissive than 600, this is a finding.

3. Verify the SSH security configuration:

grep -E "^(KexAlgorithms|MACs|Ciphers|PermitEmptyPasswords|ClientAliveInterval|ClientAliveCountMax)" /etc/ssh/sshd_config.d/stig.conf

4. Verify the configuration includes:

KexAlgorithms
MACs hmac-sha2
Ciphers aes
PermitEmptyPasswords no
ClientAliveInterval 600
ClientAliveCountMax 1

If key exchange algorithms are not configured, MACs do not use approved hmac-sha2 algorithms, ciphers do not use approved AES algorithms, empty passwords are permitted, or SSH inactivity settings are missing or configured with values other than ClientAliveInterval 600 and ClientAliveCountMax 1, this is a finding.