documentation_complete: true

title: 'Use Only Approved Ciphers'

description: |-
    Limit the ciphers to those algorithms which are FIPS-approved.
    Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode.
    The following line in <tt>/etc/ssh/sshd_config</tt>
    demonstrates use of FIPS-approved ciphers:
    <pre>Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc</pre>
    The man page <tt>sshd_config(5)</tt> contains a list of supported ciphers.

rationale: |-
    Approved algorithms should impart some level of confidence in their
    implementation. These are also required for compliance.

severity: medium

identifiers:
    cce: 26555-3

references:
    disa: 803,1144,1145,1146
    nist: AC-3,AC-17(2),SI-7,IA-5(1)(c),IA-7
    srg: SRG-OS-000169
    stigid: RHEL-06-000243

ocil_clause: 'that is not the case'

ocil: "Only FIPS-approved ciphers should be used.  To verify that only FIPS-approved \nciphers are in use, run the following command:\n<pre>$ sudo grep Ciphers /etc/ssh/sshd_config</pre>\nThe output should contain only those ciphers which are FIPS-approved, namely, the \nAES and 3DES ciphers."
