UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

RHEL 9 SSH daemon must not allow compression or must only allow compression after successful authentication.


Overview

Finding ID Version Rule ID IA Controls Severity
V-258002 RHEL-09-255130 SV-258002r991589_rule Medium
Description
If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.
STIG Date
Red Hat Enterprise Linux 9 Security Technical Implementation Guide 2024-06-04

Details

Check Text ( C-61743r952199_chk )
Verify the SSH daemon performs compression after a user successfully authenticates with the following command:

$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*compression'

Compression delayed

If the "Compression" keyword is set to "yes", is missing, or the returned line is commented out, this is a finding.
Fix Text (F-61667r925992_fix)
Configure the SSH daemon to not allow compression.

Uncomment the "Compression" keyword in "/etc/ssh/sshd_config" on the system and set the value to "delayed" or "no":

Compression no

The SSH service must be restarted for changes to take effect:

$ sudo systemctl restart sshd.service