← Back to IBM AIX 7.x Security Technical Implementation Guide

V-215296

CAT II (Medium)

The AIX SSH daemon must not allow compression.

Rule ID

SV-215296r991589_rule

STIG

IBM AIX 7.x Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000366

Discussion

If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.

Check Content

Note:  If the installed version of OpenSSH is 7.4 or above, this requirement is not applicable.

Check the SSH daemon configuration for the Compression setting by running: 
# grep -i Compression /etc/ssh/sshd_config | grep -v '^#' 
Compression no

If the setting is not present, or it is not set to "no", this is a finding.

Fix Text

Edit the "/etc/ssh/sshd_config" file and add (or modify) the following line:
Compression no

Restart the SSH daemon:
# stopsrc -s sshd
# startsrc -s sshd