Disable Compression Or Set Compression to delayed
Forces the SSH daemon to set Compression no so packet compression is not negotiated, especially before the client is authenticated.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
When SSH compression is enabled, the compression code runs before the client has authenticated. Any vulnerability in the compression library (historically the source of pre-auth memory-corruption bugs) is then reachable by an unauthenticated remote attacker, potentially leading to code execution in the privileged sshd process. Setting Compression no removes this pre-auth attack surface; the safer delayed value at least defers compression until after authentication.
What Pavois checks
Pavois reads the effective value from sshd -T, the configuration sshd actually resolved after parsing the main file, every Include, drop-ins under /etc/ssh/sshd_config.d/, and Match blocks. Grepping /etc/ssh/sshd_config alone would miss a Compression yes set in a drop-in or a crypto-policy include.
describe command('sshd -T') do
its('stdout') { should match(/^compression\s+no$/i) }
endHow to verify it is applied
Run sshd -T | grep -i '^compression'. Expected output is compression no.
Inspect & investigate
SSH session and daemon events are in /var/log/auth.log (Debian/Ubuntu) or via journalctl -u sshd (RHEL family). Negotiation/protocol errors at connection time also surface there with LogLevel VERBOSE.
Remediation
Pavois's harden plan writes the sshd_setting directive Compression no (into a managed drop-in), validates the config with sshd -t before committing, and then reloads the ssh service so the change takes effect without dropping existing sessions. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| directive | compression |
|---|---|
| notify | action: reload, service: ssh.service |
| resource | sshd_setting |
| value | no |
| verify | sshd -t -f %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling compression has no functional impact on interactive sessions and negligible effect on throughput over modern fast links; it can slightly slow bulk transfers over very slow/high-latency links where compression helped. There is no lockout risk. The harden plan reloads rather than restarts sshd, so existing connections survive; still keep a second session open when changing any sshd setting as a precaution.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | 3.1.12 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.