OpenControls Logo

STIG Viewer

STIGViewer Support

The SSH daemon must be configured to use a FIPS 140-3-compliant cryptographic algorithm.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-224044TSS0-SH-000020SV-224044r1212331_ruleCCI-000068high
Description
Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000250-GPOS-00093
STIGDate
IBM z/OS TSS Security Technical Implementation Guide2026-06-15

Related Frameworks

3 mappings across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-01.2Authenticate, Authorize and Audit (AAA)
1.00
IAC-02Identification & Authentication for Organizational Users
1.00
IAC-03Identification & Authentication for Non-Organizational Users
1.00
IAC-04Identification & Authentication for Devices
1.00
IAC-05Identification & Authentication for Third-Party Technology Assets, Applications and/or Services (TAAS)
1.00
NET-14.2Protection of Confidentiality / Integrity Using Encryption
1.00
CRY-02Automated Authentication Through Cryptographic Modules
0.50
IAC-12Cryptographic Module Authentication
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (44) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AC-4(17)Domain Authentication
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00

+34 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.13
1.00
CCI3 mappings
CCI-000068
1.00
CCI-000803
1.00
CCI-001453
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.AA-01
1.00
PR.AA-03
1.00

Who does this work

7 NICE work roles and 5 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-224044r1212331_chk)

Locate the SSH daemon configuration file found in /etc/ssh/ directory. Alternately: From the UNIX System Services ISPF Shell, navigate to ribbon select tools. Select option 1 - Work with Processes. If SSH Daemon is not active, this is not a finding. Examine the SSH daemon configuration file: sshd_config If there are no Ciphers lines, or the ciphers list contains any cipher not starting with "aes", this is a finding. If the MACs line is not configured to "hmac-sha1" or greater, this is a finding. Examine the z/OS-specific sshd server systemwide configuration: zos_sshd_config If any of the following is untrue, this is a finding: FIPSMODE=YES CiphersSource=ICSF MACsSource=ICSF

Fix Text (F-25705r1212330_fix)

Edit the SSH daemon configuration and remove any ciphers not starting with "aes". If necessary, add a "Ciphers" line using FIPS 140-3-compliant algorithms. Configure for message authentication to MACs "hmac-sha1" or greater. Edit the z/OS-specific sshd server systemwide configuration file configuration as follows: FIPSMODE=YES CiphersSource=ICSF MACsSource=ICSF