Use Only Strong MACs
Disable weak SSH Message Authentication Codes (MACs), the MD5, RIPEMD-160, 96-bit and 64-bit UMAC variants, so only strong, full-length MACs remain.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase exploitability in SSH downgrade attacks. These algorithms remain a known weak spot that grows more exploitable with increasing computing power. An attacker who breaks the MAC from a man-in-the-middle position can tamper with or decrypt the SSH tunnel and capture credentials and information. Removing them forces full-length SHA-2 MACs.
What Pavois checks
Pavois runs sshd -T and matches the effective macs line, which begins with the - exclusion of the weak MD5/96-bit/UMAC-64 algorithms. sshd -T shows the daemon's resolved configuration, after all Include, Match blocks and drop-ins, so a weak MAC re-enabled downstream is caught. Reading /etc/ssh/sshd_config directly would miss those includes and yield a false negative.
describe command('sshd -T') do
its('stdout') { should match(/^macs\s+hmac\-sha2\-512\-etm@openssh\.com,hmac\-sha2\-256\-etm@openssh\.com,hmac\-sha2\-512,hmac\-sha2\-256$/i) }
endHow to verify it is applied
Run sshd -T | grep -i '^macs' and confirm none of hmac-md5, hmac-md5-96, hmac-ripemd160, hmac-sha1-96 or umac-64@openssh.com (nor their -etm variants) appears in the resolved list. The effective line should begin with macs -hmac-md5,hmac-md5-96,....
Inspect & investigate
SSH negotiation events are logged to /var/log/auth.log (or journalctl -u ssh). A client offering only weak MACs is refused with no matching MAC found, which surfaces legacy clients before enforcement.
Remediation
This rule has no automated harden plan in Pavois yet, so it must be applied manually: add MACs -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com to a drop-in under /etc/ssh/sshd_config.d/, validate with sshd -t, then reload with systemctl reload ssh.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| directive | MACs |
|---|---|
| notify | action: reload, service: ssh.service |
| resource | sshd_setting |
| value | hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 |
| verify | sshd -t -f %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Excluding weak MACs can break very old SSH clients, embedded devices or automation that only speak MD5/96-bit MACs. Before applying, inventory your clients (modern OpenSSH already prefers SHA-2 ETM MACs) and keep a second session or console open. Validate with sshd -t before reloading, then open a fresh SSH session in a new terminal to confirm access before closing the original, preventing a lockout.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.1.15 | direct | per OS, see the benchmark table | high |
| NIST | AC-17 (2) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.