Updated ciphers and Macs info

Signed-off-by: Mark Bolwell <[email protected]>

tasks/Cat2/RHEL-09-25xxxx.yml

@@ -1063,23 +1063,6 @@
     path: /etc/crypto-policies/back-ends/openssh.config
     regexp: ^Ciphers
 
-- name: "MEDIUM | RHEL-09-255070 | PATCH | RHEL 9 SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms."
-  when:
-    - rhel_09_255070
-  tags:
-    - RHEL-09-255070
-    - CAT2
-    - CCI-001453
-    - SRG-OS-000250-GPOS-00093
-    - SV-257990r925957_rule
-    - V-257990
-    - NIST800-53R4_AC-17
-  notify: Change_requires_reboot
-  ansible.builtin.lineinfile:
-    line: "MACs {{ rhel9stig_sshd_config.macs_clients | join(',') }}"
-    path: /etc/crypto-policies/back-ends/openssh.config
-    regexp: ^MACs
-
 - name: "MEDIUM | RHEL-09-255075 | PATCH | RHEL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms."
   when:
     - rhel_09_255075
@@ -1093,9 +1076,9 @@
     - NIST800-53R4_AC-17
   notify: Change_requires_reboot
   ansible.builtin.lineinfile:
-    path: /etc/crypto-policies/back-ends/opensshserver.config
+    path: /etc/crypto-policies/back-ends/openssh.config
     regexp: ^MACs
-    line: "MACs {{ rhel9stig_sshd_config.macs_clients | join(',') + ',' + rhel9stig_sshd_config.macs_server | join(',') }}"
+    line: "MACs {{ rhel9stig_sshd_config.macs | join(',') }}"
 
 - name: "MEDIUM | RHEL-09-255080 | PATCH | RHEL 9 must not allow a noncertificate trusted host SSH logon to the system."
   when:

vars/main.yml

@@ -32,18 +32,18 @@ update_audit_template: false
 # DOD encryption
 rhel9stig_dod_ciphers:
 - [email protected]
-- [email protected]
+# - [email protected]  # Removed due to terrapin ssh cve
 - aes256-ctr
 - [email protected]
 - aes128-ctr
 rhel9stig_dod_macs:
 - [email protected]
-- [email protected]
-- [email protected]
-- [email protected]
+# - [email protected]
+# - [email protected]
 - hmac-sha2-256
-- hmac-sha1
-- [email protected]
+- [email protected]
+# - hmac-sha1
+# - [email protected]
 - hmac-sha2-512
 rhel9stig_dod_kex: