documentation_complete: true


title: 'Configure SSH to use System Crypto Policy'

description: |-
    Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
    SSH is supported by crypto policy, but the SSH configuration may be
    set up to ignore it.
    To check that Crypto Policies settings are configured correctly, ensure that
    the <tt>CRYPTO_POLICY</tt> variable is either commented or not set at all
    in the <tt>/etc/sysconfig/sshd</tt>.

rationale: |-
    Overriding the system crypto policy makes the behavior of the SSH service violate expectations,
    and makes system configuration more fragmented.

severity: medium

identifiers:
    cce@rhel8: CCE-80939-2
    cce@rhel9: CCE-83445-7
    cce@rhel10: CCE-88557-4
    cce@sle12: CCE-91639-5
    cce@sle15: CCE-85795-3
    cce@sle16: CCE-96468-4

references:
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.312(e)(1),164.312(e)(2)(ii)
    nerc-cip: CIP-003-8 R4.2,CIP-007-3 R5.1,CIP-007-3 R7.1
    nist: AC-17(a),AC-17(2),CM-6(a),MA-4(6),SC-13
    ospp: FCS_SSH_EXT.1,FCS_SSHS_EXT.1,FCS_SSHC_EXT.1
    pcidss: Req-2.2
    srg: SRG-OS-000250-GPOS-00093
    stigid@ol8: OL08-00-010287

ocil_clause: 'the CRYPTO_POLICY variable is set or is not commented out in the /etc/sysconfig/sshd'

ocil: |-
    Verify that sshd isn't configured to ignore the system wide cryptographic policy.

    Check that the <tt>CRYPTO_POLICY</tt> variable is not set or is commented out in the
    <tt>/etc/sysconfig/sshd</tt>.

    Run the following command:

    $ sudo grep CRYPTO_POLICY /etc/sysconfig/sshd

fixtext: |-
    Configure OpenSSH to not ignore the system wide cryptographic policy.
    Run the following command:

    $ sudo sed -i "/^\s*CRYPTO_POLICY.*$/Id" /etc/sysconfig/sshd

srg_requirement: |-
    {{{ full_name }}} must implement approved encryption in the OpenSSH package.

platform: system_with_kernel
