Free DISA STIG and SRG Library | Vaulted

V-14717

The network element must not use SSH Version 1 for administrative access.

Finding ID
NET1647
Rule ID
SV-15460r2_rule
Severity
Cat II
CCE
(None)
Group Title
The network element must not allow SSH Version 1.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1.

Fix Text

Configure the network device to use SSH version 2.

Check Content

If SSH is used for administrative access, then Version 2 must be configured as shown in the following example: ip ssh version 2

Responsibility

Information Assurance Officer