The SSH daemon must be configured to not use Cipher-Block Chaining (CBC) ciphers.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22459	GEN005506	SV-26752r1_rule	ECSC-1	Medium

Description
The Cipher-Block Chaining (CBC) mode of encryption as implemented in the SSHv2 protocol is vulnerable to chosen-plain text attacks and must not be used.

STIG	Date
Draft AIX Security Technical Implementation Guide	2011-08-17

Details

Check Text ( C-27761r1_chk )
Check the SSH daemon configuration for allowed ciphers. # grep -i ciphers /etc/ssh/sshd_config | grep -v '^#' If no lines are returned, or the returned ciphers list contains any cipher ending with cbc, this is a finding.

Fix Text (F-24002r1_fix)
Edit the SSH daemon configuration and remove any ciphers ending with cbc. If necessary, add a Ciphers line.