UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The SSH daemon must not allow compression or must only allow compression after successful authentication.


Overview

Finding ID Version Rule ID IA Controls Severity
V-63211 ESXI-06-000021 SV-77701r1_rule Medium
Description
If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.
STIG Date
VMware vSphere ESXi 6.0 Security Technical Implementation Guide 2017-07-11

Details

Check Text ( C-63945r1_chk )
To verify the Compression setting, run the following command:

# grep -i "^Compression" /etc/ssh/sshd_config

If there is no output or the output is not exactly "Compression no", this is a finding.
Fix Text (F-69129r1_fix)
To set the Compression setting, add or correct the following line in "/etc/ssh/sshd_config":

Compression no