documentation_complete: true

title: 'Use Only Approved MACs'

description: |-
    Limit the MACs to those hash algorithms which are FIPS-approved.
    The following line in <tt>/etc/ssh/sshd_config</tt>
    demonstrates use of FIPS-approved MACs:
    <pre>MACs hmac-sha2-512,hmac-sha2-256,hmac-sha1</pre>
    The man page <tt>sshd_config(5)</tt> contains a list of supported MACs.

rationale: |-
    Approved algorithms should impart some level of confidence in their
    implementation. These are also required for compliance.

severity: unknown

references:
    disa: 68,1453,803,2449,2450
    nist: AC-17(2),IA-7,SC-13

ocil_clause: 'that is not the case'

ocil: |-
    Only FIPS-approved MACs should be used.  To verify that only FIPS-approved
    MACs are in use, run the following command:
    <pre>$ sudo grep -i macs /etc/ssh/sshd_config</pre>
    The output should contain only those MACs which are FIPS-approved, namely,
    hmac-sha2-512, hmac-sha2-256, and hmac-sha1 hash functions.
