UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The AIX SSH daemon must be configured to only use FIPS 140-2 approved ciphers.


Overview

Finding ID Version Rule ID IA Controls Severity
V-91243 AIX7-00-003100 SV-101343r1_rule Medium
Description
Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection (e.g., RDP), thereby providing a degree of confidentiality. The encryption strength of a mechanism is selected based on the security categorization of the information.
STIG Date
IBM AIX 7.x Security Technical Implementation Guide 2019-04-29

Details

Check Text ( C-90399r1_chk )
Check the SSH daemon configuration for allowed ciphers by running the following command:
# grep -i ciphers /etc/ssh/sshd_config | grep -v '^#'

The above command should yield the following output:
Ciphers aes128-ctr,aes192-ctr,aes256-ctr

If any of the following conditions are true, this is a finding.
1. No line is returned (default ciphers);
2. The returned ciphers list contains any cipher not starting with aes;
3. The returned ciphers list contains any cipher ending with cbc.
Fix Text (F-97443r1_fix)
Edit the "/etc/ssh/sshd_config" file and add or edit a "Ciphers" line like this:
Ciphers aes128-ctr,aes192-ctr,aes256-ctr

Restart the SSH daemon:
# stopsrc -s sshd
# startsrc -s sshd