The macOS system must implement approved Message Authentication Codes (MACs) within the SSH client configuration.
An XCCDF Rule
Description
Operating systems using encryption are required to use FIPS-compliant mechanisms for authenticating to macOS. For OpenSSH to utilize the Apple Corecrypto FIPS-validated algorithms, a specific configuration is required to leverage the shim implemented by macOS to bypass the non-FIPS validated LibreSSL crypto module packaged with OpenSSH. Information regarding this configuration can be found in the manual page "apple_ssh_and_fips". Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00175
- ID
- SV-257774r922867_rule
- Version
- APPL-12-000058
- Severity
- High
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the macOS system to use approved SSH MACs by creating a plain text file in the /private/etc/ssh/ssh_config.d/ directory containing the following:
MACs hmac-sha2-256
The SSH service must be restarted for changes to take effect.