documentation_complete: true

title: 'Disable Compression Or Set Compression to delayed'

description: |-
    Compression is useful for slow network connections over long
    distances but can cause performance issues on local LANs. If use of compression
    is required, it should be enabled only after a user has authenticated; otherwise,
    it should be disabled. To disable compression or delay compression until after
    a user has successfully authenticated, add or correct the following line in the
    <tt>/etc/ssh/sshd_config</tt> file:
    <pre>Compression {{{ xccdf_value("var_sshd_disable_compression") }}}</pre>

rationale: |-
    If compression is allowed in an SSH connection prior to authentication,
    vulnerabilities in the compression software could result in compromise of the
    system from an unauthenticated connection, potentially with root privileges.

severity: medium

identifiers:
    cce@rhel8: CCE-80895-6
    cce@rhel9: CCE-90801-2
    cce@rhel10: CCE-90051-4
    cce@sle12: CCE-83062-0
    cce@sle15: CCE-85647-6
    cce@sle16: CCE-96158-1

references:
    cis-csc: 11,3,9
    cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05
    cui: 3.1.12
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
    isa-62443-2009: 4.3.4.3.2,4.3.4.3.3
    isa-62443-2013: 'SR 7.6'
    iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4
    nist: AC-17(a),CM-7(a),CM-7(b),CM-6(a)
    nist-csf: PR.IP-1
    srg: SRG-OS-000480-GPOS-00227
    stigid@ol7: OL07-00-040470
    stigid@sle12: SLES-12-030250

ocil_clause: 'it is commented out, or is not set to no or delayed'

ocil: |-
    To check if compression is enabled or set correctly, run the
    following command:
    <pre>$ sudo grep Compression /etc/ssh/sshd_config</pre>
    If configured properly, output should be <pre>no</pre> or <pre>delayed</pre>.

{{% if product == "ol7" %}}
platform: os_linux[ol]<7.4
{{% elif product == "sle12" %}}
platform: package[openssh]<7.4
{{% endif %}}

fixtext: '{{{ fixtext_sshd_lineinfile("Compression", xccdf_value("var_sshd_disable_compression"), no) }}}'

srg_requirement: 'The {{{ full_name }}} SSH daemon must not allow compression or must only allow compression after successful authentication.'

template:
    name: sshd_lineinfile
    vars:
        parameter: Compression
        xccdf_variable: var_sshd_disable_compression
        datatype: string

