UCF STIG Viewer Logo

The SSH daemon must not allow compression or must only allow compression after successful authentication.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22488 GEN005539 SV-40723r1_rule ECSC-1 Medium
Description
If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.
STIG Date
AIX 5.3 SECURITY TECHNICAL IMPLEMENTATION GUIDE 2014-10-03

Details

Check Text ( C-39454r1_chk )
Check the SSH daemon configuration for the Compression setting.

# grep -i Compression /etc/ssh/sshd_config | grep -v '^#'

If the setting is present and set to "yes", this is a finding. If the setting is absent or set to "no" or "delayed", this is not a finding.
Fix Text (F-34582r1_fix)
Edit the /etc/ssh/sshd_config file and remove the Compression setting or set the Compression setting to "delayed" or "no".