← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-4295

CAT I (High)

The SSH daemon must be configured to only use the SSHv2 protocol.

Rule ID

SV-45997r2_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-001436

Discussion

SSHv1 is not a DoD-approved protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system.

Check Content

Locate the sshd_config file: 
# more /etc/ssh/sshd_config

Examine the file. If the variables 'Protocol 2,1’ or ‘Protocol 1’ are defined on a line without a leading comment, this is a finding.

Fix Text

Edit the sshd_config file and set the "Protocol" setting to "2". 

Restart the SSH daemon.
# /sbin/service sshd restart