The SSH client must be configured to only use the SSHv2 protocol.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| GEN005501-ESXI5-9778 | GEN005501-ESXI5-9778 | GEN005501-ESXI5-9778_rule | Medium |
| Description |
|---|
| SSHv1 is not a DoD-approved protocol and has many well-known vulnerability exploits. Exploits of the SSH client could provide access to the system with the privileges of the user running the client. |
| STIG | Date |
|---|---|
| VMware ESXi v5 Security Technical Implementation Guide | 2013-01-15 |
Details
| Check Text ( C-GEN005501-ESXI5-9778_chk ) |
|---|
| Disable lock down mode. Enable the ESXi Shell. Check the SSH client configuration for required protocol. # grep -i "Protocol 2" /etc/ssh/ssh_config | grep -v '^#' Re-enable lock down mode. If no lines are returned, or the returned protocol list contains anything except 2, this is a finding. |
| Fix Text (F-GEN005501-ESXI5-9778_fix) |
|---|
| Disable lock down mode. Enable the ESXi Shell. Edit the SSH client configuration and add/modify the "Protocol" configuration for Protocol 2 only. # vi /etc/ssh/ssh_config Re-enable lock down mode. |