Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-252460 | APPL-12-000055 | SV-252460r922858_rule | High |
Description |
---|
Operating systems using encryption are required to use FIPS-compliant mechanisms for authenticating to macOS. For OpenSSH to utilize the Apple Corecrypto FIPS-validated algorithms, a specific configuration is required to leverage the shim implemented by macOS to bypass the non-FIPS validated LibreSSL crypto module packaged with OpenSSH. Information regarding this configuration can be found in the manual page "apple_ssh_and_fips". Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00175 |
STIG | Date |
---|---|
Apple macOS 12 (Monterey) Security Technical Implementation Guide | 2023-08-28 |
Check Text ( C-55916r922856_chk ) |
---|
Verify the macOS system is configured to use approved SSH MACs within the SSH server configuration with the following command: /usr/bin/sudo /usr/sbin/sshd -T | /usr/bin/grep "macs" macs hmac-sha2-256 If any hashes other than "hmac-sha2-256" are listed, or the "macs" keyword is missing, this is a finding. |
Fix Text (F-55866r922857_fix) |
---|
Configure the macOS system to use approved SSH MACs by creating a plain text file in the /private/etc/ssh/sshd_config.d/ directory containing the following: MACs hmac-sha2-256 The SSH service must be restarted for changes to take effect. |