The macOS system must implement approved ciphers within the SSH server configuration to protect the confidentiality of SSH connections.

STIG ID: APPL-13-000054  |  SRG: SRG-OS-000033-GPOS-00014 |  Severity: high |  CCI: CCI-000068,CCI-000803,CCI-000877,CCI-001453,CCI-002890,CCI-003123 |  Vulnerability Id: V-257165

Vulnerability Discussion

Operating systems using encryption are required to use FIPS-compliant mechanisms for authenticating to macOS.

For OpenSSH to utilize the Apple Corecrypto FIPS-validated algorithms, a specific configuration is required to leverage the shim implemented by macOS to bypass the non-FIPS validated LibreSSL crypto module packaged with OpenSSH. Information regarding this configuration can be found in the manual page "apple_ssh_and_fips".

Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174

Check

Verify the macOS system is configured to use approved SSH ciphers within the SSH server configuration with the following command:

/usr/bin/sudo /usr/sbin/sshd -T | /usr/bin/grep "ciphers"

ciphers [email protected]

If any ciphers other than "[email protected]" are listed, or the "ciphers" keyword is missing, this is a finding.

Fix

Configure the macOS system to use approved SSH ciphers by creating a plain text file in the /private/etc/ssh/sshd_config.d/ directory containing the following:

Ciphers [email protected]

The SSH service must be restarted for changes to take effect.
This website is not created by, run, approved, or endorsed by the U.S. Department of Defense. Use at your own risk. This website is created by open-source software.