The SSH daemon must be configured to not use Cipher-Block Chaining (CBC) ciphers.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
GEN005506-ESXI5-000098	GEN005506-ESXI5-000098	GEN005506-ESXI5-000098_rule		Medium

Description
The Cipher-Block Chaining (CBC) mode of encryption as implemented in the SSHv2 protocol is vulnerable to chosen plain text attacks and must not be used.

STIG	Date
VMware ESXi v5 Security Technical Implementation Guide	2013-01-15

Details

Check Text ( C-GEN005506-ESXI5-000098_chk )
Disable lock down mode. Enable the ESXi Shell. Check the SSH daemon configuration for allowed ciphers (examples of disallowed ciphers: aes128-cbc, aes192-cbc, aes256-cbc, arcfour256blowfish-cbc, cast128-cbc, 3des-cbc). # grep -i ciphers /etc/ssh/sshd_config \| grep -v '^#' Re-enable lock down mode. If no lines are returned, or the returned ciphers list contains any cipher ending with cbc, this is a finding.

Check Text ( C-GEN005506-ESXI5-000098_chk )

Disable lock down mode.
Enable the ESXi Shell.

Check the SSH daemon configuration for allowed ciphers (examples of disallowed ciphers: aes128-cbc, aes192-cbc, aes256-cbc, arcfour256blowfish-cbc, cast128-cbc, 3des-cbc).

# grep -i ciphers /etc/ssh/sshd_config | grep -v '^#'

Re-enable lock down mode.

If no lines are returned, or the returned ciphers list contains any cipher ending with cbc, this is a finding.

Fix Text (F-GEN005506-ESXI5-000098_fix)
Disable lock down mode. Enable the ESXi Shell. Edit the SSH daemon configuration and add/modify the "Ciphers" configuration (examples of disallowed ciphers: aes128-cbc, aes192-cbc, aes256-cbc, arcfour256blowfish-cbc, cast128-cbc, 3des-cbc). # vi /etc/ssh/sshd_config Re-enable lock down mode.