# Ensure sshd MACs are configured

Necessity: The Message Authentication Code (MAC) algorithm is a cryptographic checksum used to verify the integrity and authenticity of data transmitted over the SSH connection. Configuring a strong set of MACs prevents an attacker from altering data in transit (a man-in-the-middle attack) without detection. Using weak or compromised MACs (such as those based on MD5 or SHA-1) can expose the session to data tampering. Auditing and Remediation: The audit script inspects the SSH server's active configuration to identify the currently permitted list of MAC algorithms. The remediation script directly modifies the '/etc/ssh/sshd_config' file to enforce a specified list of secure MACs and then reloads the service for the changes to take effect. Recommended State Rationale: Basic: This state, aligned with CIS benchmarks, removes all known weak MACs (e.g., hmac-md5, hmac-sha1) and enforces a list of strong, modern algorithms. It includes both Encrypt-then-MAC (ETM) modes, which are cryptographically preferred, and standard HMAC-SHA2 variants for broad compatibility. Moderate: This state enhances security by removing the non-ETM variants and the UMAC algorithm. It exclusively allows the strongest ETM modes, which provide a more robust cryptographic sequence by performing the integrity check after encryption. Strict: This state provides the highest level of security by permitting only the single strongest algorithm available, 'hmac-sha2-512-etm@openssh.com'. This configuration minimizes the attack surface but may reduce compatibility with older SSH clients that do not support this specific MAC.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256']` |
| **Moderate** | `['hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com']` |
| **Strict** | `['hmac-sha2-512-etm@openssh.com']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the effective SSH daemon configuration for the 'MACs' setting. The script must parse this output to return only the comma-separated list of MAC algorithms. The output must be a single line containing only the value, with no labels or additional text.

## Remediation Script Working

Bash script that accepts a single positional command-line argument: a comma-separated string of recommended MAC algorithms. The script must find the line starting with 'MACs' in '/etc/ssh/sshd_config', replace its value with the provided argument, or add the line if it does not exist. After updating the configuration, the script must reload the 'sshd' service. The script must return 'true' upon successful completion and 'false' if any step fails.

