Use Only FIPS 140-2 Validated Ciphers
Description
Limit the ciphers to those algorithms which are FIPS-approved.
Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode.
The following line in /etc/ssh/sshd_config
demonstrates use of FIPS-approved ciphers:
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
The man page sshd_config(5) contains a list of supported ciphers.
The rule is parametrized to use the following ciphers: .
Rationale
Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore
cannot be relied upon to provide confidentiality or integrity, and system data may be compromised.
Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to
cryptographic modules.
FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules
utilize authentication that meets industry and government requirements. For government systems, this allows
Security Levels 1, 2, 3, or 4 for use on Ubuntu 20.04.
Shell script
The following script can be run on the host to remediate the issue.
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
sshd\_approved\_ciphers=''
# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped\_key=$(sed 's/[\^=\$,;+]\*//g' <<< "^Ciphers")
# shellcheck disable=SC2059
printf -v formatted\_output "%s %s" "$stripped\_key" "$sshd\_approved\_ciphers"
# If the key exists, change it. Otherwise, add it to the config\_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC\_ALL=C grep -q -m 1 -i -e "^Ciphers\\>" "/etc/ssh/sshd\_config"; then
escaped\_formatted\_output=$(sed -e 's|/|\\/|g' <<< "$formatted\_output")
LC\_ALL=C sed -i --follow-symlinks "s/^Ciphers\\>.\*/$escaped\_formatted\_output/gi" "/etc/ssh/sshd\_config"
else
if [[ -s "/etc/ssh/sshd\_config" ]] && [[ -n "$(tail -c 1 -- "/etc/ssh/sshd\_config" || true)" ]]; then
LC\_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/ssh/sshd\_config"
fi
printf '%s\n' "$formatted\_output" >> "/etc/ssh/sshd\_config"
fi
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Warning
The system needs to be rebooted for these changes to take effect.
