documentation_complete: true

title: 'Allow Only SSH Protocol 2'

description: |-
    Only SSH protocol version 2 connections should be
    permitted. The default setting in
    <tt>/etc/ssh/sshd_config</tt> is correct, and can be
    verified by ensuring that the following
    line appears:
    <pre>Protocol 2</pre>

rationale: |-
    SSH protocol version 1 suffers from design flaws that
    result in security vulnerabilities and
    should not be used.

severity: high

identifiers:
    cce: 27072-8

references:
    disa: 776,774,1436
    nist: AC-3(10),IA-5(1)(c)
    srg: SRG-OS-000112
    stigid: RHEL-06-000227

ocil_clause: 'it is not'

ocil: |-
    To check which SSH protocol version is allowed, run the following command:
    <pre>$ sudo grep Protocol /etc/ssh/sshd_config</pre>
    If configured properly, output should be <pre>Protocol 2</pre>
