Configuring SSH - restrict Cipher list

HighLevel 1Manual reviewibm-i

Description

This variable limits the types of ciphers that SSH can use during communication. Based on research conducted at various institutions, it was determined that the symmetric portion of the SSH Transport Protocol (as described in RFC 4253) has security weaknesses that allowed recovery of up to 32 bits of plaintext from a block of ...

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

DSPF '/QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config' On the Control field, type Ciphers and press F16 (shift F4) Control: Ciphers_________________________________________ The display should yield the following output: Ciphers aes256-ctr,aes192-ctr,aes128-ctr

How it is fixed

Fix method: Guidance or infrastructure patch

EDTF '/QOpenSys/QIBM/UserData/SC1/OpenSSH/etc/sshd'_config file: Insert: Ciphers aes256-ctr,aes192-ctr,aes128-ctr Re-cycle the sshd daemon to pick up the configuration changes:

Properties

Operating systems: Any
Tags: ibm-issh
Reference: CIS IBM i V7R5M0 Benchmark v2.1.0 - 5.4.7 Configuring SSH - restrict Cipher list