cis-ubuntu1804-v220-4-2-14

name	cis-ubuntu1804-v220-4-2-14
description	Ensure sshd MACs are configured
category	cis-networking
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","ssh","remote-access"]
cis_id	4.2.14
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 4.2.14

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

This variable limits the types of MAC algorithms that SSH can use during communication.

Rationale

MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase exploitability without any practical increase in performance. Their use diminishes the security of the SSH connection. Weak MAC algorithms that should not be used include hmac-md5, hmac-md5-96, hmac-sha1-96, [e-mail], [e-mail], [e-mail], [e-mail], [e-mail].

Audit Procedure

Command Line

Run the following command and verify that only approved MACs are used:

sshd -T | grep -i macs

Expected Result

Verify that output does not contain any of the following weak MACs:

• hmac-md5
• hmac-md5-96
• hmac-sha1-96
• [e-mail]
• [e-mail]
• [e-mail]
• [e-mail]
• [e-mail]

Remediation

Command Line

Edit the /etc/ssh/sshd_config file and add/modify the MACs line to contain a comma separated list of the site approved MACs.

Example:

MACs [e-mail],[e-mail],hmac-sha2-512,hmac-sha2-256

References

1. NIST SP 800-53 Rev. 5: AC-17(2), IA-5(1), SC-13

CIS Controls

v8 - 3.10 Encrypt Sensitive Data in Transit - Encrypt sensitive data in transit.

v7 - 14.4 Encrypt All Sensitive Information in Transit.

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Assessment Status

Automated