# Ensure sshd MACs are configured

Necessity: The Message Authentication Code (MAC) algorithm in SSH is a cryptographic checksum used to verify the integrity and authenticity of data transmitted over the secure channel. It protects against data tampering and man-in-the-middle attacks. Using weak or outdated MAC algorithms (such as those based on MD5 or SHA-1) exposes the SSH session to cryptographic attacks that could allow an attacker to modify the data stream without detection. Enforcing a list of strong, modern MACs is critical for maintaining the confidentiality and integrity of SSH communications.

Auditing and Remediation: The audit script inspects the active SSH server configuration to identify the list of currently allowed MAC algorithms. The remediation script modifies the '/etc/ssh/sshd_config' file by setting the 'MACs' parameter to a specified list of approved, strong algorithms, ensuring that any weak defaults or insecure user configurations are corrected. It then restarts the SSH service for the changes to take effect.

Recommended State Rationale:
- Basic: This state aligns with CIS benchmarks, removing all cryptographically broken algorithms (e.g., hmac-md5, hmac-sha1) and enforcing a secure baseline of modern SHA-2 based MACs. It provides a robust defense against common integrity attacks while maintaining broad client compatibility.
- Moderate: This state improves upon the basic level by exclusively using 'Encrypt-then-MAC' (etm) variants. 'etm' is a more secure mode of operation for authenticated encryption, provably preventing certain types of subtle attacks possible against other modes. This enhances the cryptographic soundness of the connection.
- Strict: This state offers the highest level of security by limiting the MACs to only the strongest available SHA-2 'etm' algorithms. This minimizes the attack surface by reducing cryptographic complexity and choice, but it may impact compatibility with older SSH clients that do not support these specific, modern MACs. It is best suited for environments where all clients are known to be up-to-date.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256']` |
| **Moderate** | `['hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com']` |
| **Strict** | `['hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the effective SSH server configuration for the 'macs' setting. The script must execute 'sshd -T | grep "^macs " | cut -d' ' -f2' to extract and return only the comma-separated list of configured MAC algorithms. If the command returns no output, the script should return an empty string.

## Remediation Script Working

Bash script that accepts a single positional command-line argument: a comma-separated string of MAC algorithms. The script must modify the '/etc/ssh/sshd_config' file to set the 'MACs' directive to this value. If the 'MACs' line exists, it should be replaced; if not, it should be added. The script must then restart the sshd service to apply the changes and return 'true' upon successful completion or 'false' if any step fails.

