The SSH daemon must be configured to only use the SSHv2 protocol.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-4295	GEN005500	SV-4295r6_rule	DCPP-1	High

Description
SSHv1 is not a DoD-approved protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system.

STIG	Date
Draft AIX Security Technical Implementation Guide	2011-08-17

Details

Check Text ( C-1875r3_chk )
Locate the sshd_config file. # find / -name sshd_config # more Examine the file. If the variables Protocol 2,1 or Protocol 1 are defined on a line without a leading comment, this is a finding. If the SSH server is F-Secure, the variable name for SSH 1 compatibility is Ssh1Compatibility, not protocol. If the variable Ssh1Compatiblity is set to yes, this is a finding.

Fix Text (F-4206r2_fix)
Edit the sshd_config file and set the Protocol setting to 2. If using the F-Secure SSH server, set the Ssh1Compatibility setting to no.