This is not the latest version of the STIG. This is provided for archival purposes. See the latest STIG.
The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.
DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions. The only SSHv2 hash algorithm meeting this requirement is SHA.
Check
Verify the SSH daemon is configured to only use MACs employing FIPS 140-2-approved ciphers.
Note: If RHEL-07-021350 is a finding, this is automatically a finding as the system cannot implement FIPS 140-2-approved cryptographic algorithms and hashes.
Check that the SSH daemon is configured to only use MACs employing FIPS 140-2-approved ciphers with the following command:
If any ciphers other than "hmac-sha2-256" or "hmac-sha2-512" are listed or the returned line is commented out, this is a finding.
Fix
Edit the "/etc/ssh/sshd_config" file to uncomment or add the line for the "MACs" keyword and set its value to "hmac-sha2-256" and/or "hmac-sha2-512" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):
MACs hmac-sha2-256,hmac-sha2-512
The SSH service must be restarted for changes to take effect.