UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The macOS system must implement approved ciphers within the SSH client configuration to protect the confidentiality of SSH connections.


Overview

Finding ID Version Rule ID IA Controls Severity
V-257773 APPL-12-000057 SV-257773r922864_rule High
Description
Operating systems using encryption are required to use FIPS-compliant mechanisms for authenticating to macOS. For OpenSSH to utilize the Apple Corecrypto FIPS-validated algorithms, a specific configuration is required to leverage the shim implemented by macOS to bypass the non-FIPS validated LibreSSL crypto module packaged with OpenSSH. Information regarding this configuration can be found in the manual page "apple_ssh_and_fips". Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174
STIG Date
Apple macOS 12 (Monterey) Security Technical Implementation Guide 2023-08-28

Details

Check Text ( C-61514r922862_chk )
Verify the macOS system is configured to use approved SSH ciphers within the SSH client configuration with the following command:

/usr/bin/sudo /usr/bin/grep -ir "ciphers" /etc/ssh/ssh_config*

/etc/ssh/ssh_config.d/fips_ssh_config:Ciphers aes128-gcm@openssh.com

If any ciphers other than "aes128-gcm@openssh.com" are listed, or the "ciphers" keyword is missing, this is a finding.
Fix Text (F-61438r922863_fix)
Configure the macOS system to use approved SSH ciphers by creating a plain text file in the /private/etc/ssh/ssh_config.d/ directory containing the following:

Ciphers aes128-gcm@openssh.com

The SSH service must be restarted for changes to take effect.