UCF STIG Viewer Logo

The SSH client must be configured to only use FIPS 140-2 approved ciphers.


Overview

Finding ID Version Rule ID IA Controls Severity
GEN005510-ESXI5-700 GEN005510-ESXI5-700 GEN005510-ESXI5-700_rule Medium
Description
DoD information systems are required to use FIPS 140-2 approved ciphers. SSHv2 ciphers meeting this requirement are 3DES and AES.
STIG Date
VMware ESXi v5 Security Technical Implementation Guide 2013-01-15

Details

Check Text ( C-GEN005510-ESXI5-700_chk )
Disable lock down mode.
Enable the ESXi Shell.

Check the SSH daemon configuration for allowed ciphers. # grep -i ciphers /etc/ssh/ssh_config | grep -v '^#'

Re-enable lock down mode.

If no lines are returned, or the returned ciphers list contains any cipher not starting with 3des or aes, this is a finding.
Fix Text (F-GEN005510-ESXI5-700_fix)
Disable lock down mode.
Enable the ESXi Shell.

Edit the SSH daemon configuration and add/modify the "Ciphers" configuration.
# vi /etc/ssh/ssh_config

Re-enable lock down mode.