Use Only Strong Ciphers
Restrict the SSH server to strong symmetric Ciphers only, AES in CTR and GCM modes plus chacha20-poly1305@openssh.com, excluding CBC and other weak ciphers.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Research on the SSH Transport Protocol (RFC 4253) showed that the Cipher Block Chaining (CBC) mode has security weaknesses that allowed recovery of up to 32 bits of plaintext from a ciphertext block. The Counter (CTR) mode ciphers (RFC 4344) and modern AEAD ciphers (GCM, ChaCha20-Poly1305) are not vulnerable to these attacks and are recommended for standard use. Leaving CBC or arcfour ciphers enabled exposes the session to plaintext-recovery and downgrade attacks against the encrypted tunnel.
What Pavois checks
Pavois runs sshd -T and matches the effective ciphers line against the strong list. sshd -T reports the cipher set the daemon actually resolved, after every Include, Match block and drop-in in /etc/ssh/sshd_config.d/, so a CBC cipher re-enabled by a drop-in is detected. Parsing /etc/ssh/sshd_config alone would miss those includes and yield a false negative.
describe command('sshd -T') do
its('stdout') { should match(/^ciphers\s+aes128\-ctr,aes192\-ctr,aes256\-ctr,chacha20\-poly1305@openssh\.com,aes256\-gcm@openssh\.com,aes128\-gcm@openssh\.com$/i) }
endHow to verify it is applied
Run sshd -T | grep -i '^ciphers'. Expected output:
ciphers aes128-ctr,aes192-ctr,aes256-ctr,chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
No -cbc or arcfour cipher should be present.
Inspect & investigate
SSH connection and negotiation events are in /var/log/auth.log (or journalctl -u ssh). A client that only offers a weak cipher is refused with no matching cipher found, which surfaces legacy clients in those logs.
Remediation
Pavois's harden plan writes the Ciphers directive (sshd_setting resource) with the strong cipher list into the SSH drop-in configuration and reloads sshd. Apply it with pavois harden apply. The new list takes effect on the next connection; current sessions stay up.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| directive | Ciphers |
|---|---|
| notify | action: reload, service: ssh.service |
| resource | sshd_setting |
| value | aes128-ctr,aes192-ctr,aes256-ctr,chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com |
| verify | sshd -t -f %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling CBC/arcfour ciphers can break legacy SSH clients, old network appliances or jump hosts that lack CTR/GCM support. Before applying, confirm your clients (any recent OpenSSH already negotiates these strong ciphers) and keep a second session or console open. After applying, open a fresh SSH connection in a new terminal to verify access before closing the original, this prevents a lockout.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.1.6 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.