CCI-000068 in U Apple macOS 14 V2R2

ℹ️ The items you can view are limited because you do not have a subscription. Contact us at [email protected] to purchase one.

UNCLASSIFIED
Group Title
SRG-OS-000033-GPOS-00014
Group ID
V-259438
Rule Version
APPL-14-000054
Rule Title
The macOS system must limit SSHD to FIPS-compliant connections.
Rule ID
SV-259438r958408_rule
Rule Severity
● High
Rule Weight
10.0
Vuln Discussion

If SSHD is enabled then it must be configured to limit the Ciphers, HostbasedAcceptedAlgorithms, HostKeyAlgorithms, KexAlgorithms, MACs, PubkeyAcceptedAlgorithms, CASignatureAlgorithms to algorithms that are FIPS 140 validated.

FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meet federal requirements.

Operating systems utilizing encryption must use FIPS validated mechanisms for authenticating to cryptographic modules.

Note: For more information on FIPS compliance with the version of SSHD included in the macOS, the manual page apple_ssh_and_fips has additional information.

Satisfies: SRG-OS-000033-GPOS-00014,SRG-OS-000120-GPOS-00061,SRG-OS-000250-GPOS-00093,SRG-OS-000393-GPOS-00173,SRG-OS-000394-GPOS-00174,SRG-OS-000396-GPOS-00176,SRG-OS-000424-GPOS-00188,SRG-OS-000478-GPOS-00223

Documentable
False
Check Content

Verify the macOS system is configured to limit SSHD to FIPS-compliant connections with the following command:

fips_sshd_config=("Ciphers [email protected]" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]" "HostKeyAlgorithms ecdsa-sha2-nistp256,[email protected]" "KexAlgorithms ecdh-sha2-nistp256" "MACs hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]" "CASignatureAlgorithms ecdsa-sha2-nistp256")

total=0

for config in $fips_sshd_config; do

total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total)

done

echo $total

If the result is not "7", this is a finding.

Check System
C-63177r945373_chk
Fix Reference
F-63085r945374_fix
Fix Text

Configure the macOS system to limit SSHD to FIPS-compliant connections with the following command:

fips_sshd_config="Ciphers [email protected]

HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]

HostKeyAlgorithms ecdsa-sha2-nistp256,[email protected]

KexAlgorithms ecdh-sha2-nistp256

MACs hmac-sha2-256

PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]

CASignatureAlgorithms ecdsa-sha2-nistp256"

/bin/echo "${fips_sshd_config}" > /etc/ssh/sshd_config.d/fips_sshd_config

Identities
CCI-000068

Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.

  • 800-53 :: AC-17 (2)
  • 800-53 Rev. 4 :: AC-17 (2)
  • 800-53 Rev. 5 :: AC-17 (2)
  • 800-53A :: AC-17 (2).1
CCI-000803

Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

  • 800-53 :: IA-7
  • 800-53 Rev. 4 :: IA-7
  • 800-53 Rev. 5 :: IA-7
  • 800-53A :: IA-7.1
CCI-001453

Implement cryptographic mechanisms to protect the integrity of remote access sessions.

  • 800-53 :: AC-17 (2)
  • 800-53 Rev. 4 :: AC-17 (2)
  • 800-53 Rev. 5 :: AC-17 (2)
  • 800-53A :: AC-17 (2).1
CCI-002421

Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.

  • 800-53 Rev. 4 :: SC-8 (1)
  • 800-53 Rev. 5 :: SC-8 (1)
CCI-002450

Implement organization-defined types of cryptography for each specified cryptography use.

  • 800-53 Rev. 4 :: SC-13
  • 800-53 Rev. 5 :: SC-13 b
CCI-002890

Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.

  • 800-53 Rev. 4 :: MA-4 (6)
  • 800-53 Rev. 5 :: MA-4 (6)
CCI-003123

Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

  • 800-53 Rev. 4 :: MA-4 (6)
  • 800-53 Rev. 5 :: MA-4 (6)
Group Title
SRG-OS-000033-GPOS-00014
Group ID
V-259439
Rule Version
APPL-14-000057
Rule Title
The macOS system must limit SSH to FIPS-compliant connections.
Rule ID
SV-259439r958408_rule
Rule Severity
● High
Rule Weight
10.0
Vuln Discussion

SSH must be configured to limit the Ciphers, HostbasedAcceptedAlgorithms, HostKeyAlgorithms, KexAlgorithms, MACs, PubkeyAcceptedAlgorithms, CASignatureAlgorithms to algorithms that are FIPS 140 validated.

FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meet federal requirements.

Operating systems utilizing encryption must use FIPS-validated mechanisms for authenticating to cryptographic modules.

Note: For more information on FIPS compliance with the version of SSH included in the macOS, the manual page apple_ssh_and_fips has additional information.

Satisfies: SRG-OS-000033-GPOS-00014,SRG-OS-000120-GPOS-00061,SRG-OS-000250-GPOS-00093,SRG-OS-000396-GPOS-00176,SRG-OS-000424-GPOS-00188,SRG-OS-000478-GPOS-00223

Documentable
False
Check Content

Verify the macOS system is configured to limit SSH to FIPS-compliant connections with the following command:

fips_ssh_config="Host *

Ciphers [email protected]

HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]

HostKeyAlgorithms ecdsa-sha2-nistp256,[email protected]

KexAlgorithms ecdh-sha2-nistp256

MACs hmac-sha2-256

PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]

CASignatureAlgorithms ecdsa-sha2-nistp256"

/usr/bin/grep -c "$fips_ssh_config" /etc/ssh/ssh_config.d/fips_ssh_config

If the result is not "8", this is a finding.

Check System
C-63178r945375_chk
Fix Reference
F-63086r945376_fix
Fix Text

Configure the macOS system to limit SSH to FIPS-compliant connections with the following command:

fips_ssh_config="Host *

Ciphers [email protected]

HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]

HostKeyAlgorithms ecdsa-sha2-nistp256,[email protected]

KexAlgorithms ecdh-sha2-nistp256

MACs hmac-sha2-256

PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]

CASignatureAlgorithms ecdsa-sha2-nistp256"

/bin/echo "${fips_ssh_config}" > /etc/ssh/ssh_config.d/fips_ssh_config

Identities
CCI-000068

Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.

  • 800-53 :: AC-17 (2)
  • 800-53 Rev. 4 :: AC-17 (2)
  • 800-53 Rev. 5 :: AC-17 (2)
  • 800-53A :: AC-17 (2).1
CCI-000803

Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

  • 800-53 :: IA-7
  • 800-53 Rev. 4 :: IA-7
  • 800-53 Rev. 5 :: IA-7
  • 800-53A :: IA-7.1
CCI-001453

Implement cryptographic mechanisms to protect the integrity of remote access sessions.

  • 800-53 :: AC-17 (2)
  • 800-53 Rev. 4 :: AC-17 (2)
  • 800-53 Rev. 5 :: AC-17 (2)
  • 800-53A :: AC-17 (2).1
CCI-002421

Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.

  • 800-53 Rev. 4 :: SC-8 (1)
  • 800-53 Rev. 5 :: SC-8 (1)
CCI-002450

Implement organization-defined types of cryptography for each specified cryptography use.

  • 800-53 Rev. 4 :: SC-13
  • 800-53 Rev. 5 :: SC-13 b
UNCLASSIFIED