BaselineWatch
Apply as published
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

Linux RHEL-10-300050

DISA STIG RHEL-10-300050 (CAT I): RHEL 10 must be configured so that Secure Shell (SSH) clients use only DoW-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.

DISA STIG recommends

RHEL-10-300050 CAT I

RHEL 10 must be configured so that Secure Shell (SSH) clients use only DoW-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.

NIST SP 800-53: AC-17(2), MA-4

Check

Verify RHEL 10 SSH clients are configured to use only MACs employing FIPS 140-3-approved algorithms. To verify the MACs in the systemwide SSH configuration file, use the following command: $ sudo grep -i MACs /etc/crypto-policies/back-ends/openssh.config MACs [email protected],[email protected],hmac-sha2-256,hmac-sha2-512 If the MACs entries in the "openssh.config" file have any hashes other than "[email protected],[email protected],hmac-sha2-256,hmac-sha2-512", or they are missing or commented out, this is a finding.

Fix

Configure RHEL 10 SSH clients to use only MACs employing FIPS 140-3-approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

Our decision

Apply as published

No decision recorded: the recommendation stands. The owner signs in to change it.

All Linux decisions · The Linux baseline · The Linux test plan