How do I install the Cis GCP Cos 5.1.14 skill?

Run npx skillmds@latest add cyberstrikeus/cis-gcp-cos-5-1-14 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis GCP Cos 5.1.14 skill do?

Ensure only strong MAC algorithms are used It is listed under DevOps & Infra on SkillMD.

Is Cis GCP Cos 5.1.14 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis GCP Cos 5.1.14?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis GCP Cos 5.1.14 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis GCP Cos 5.1.14?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis GCP Cos 5.1.14 by cyberstrikeus

Name: Cis GCP Cos 5.1.14
Author: cyberstrikeus

File contents

5.1.14 Ensure only strong MAC algorithms are used (Automated)

Description

This variable limits the types of MAC algorithms that SSH can use during communication.

Rationale

MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of attention as a weak spot that can be exploited with expanded computing power. An attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the SSH tunnel and capture credentials and information.

Audit Procedure

Run the following command and verify that output does not contain any of the listed weak MAC algorithms:

# sshd -T | grep -i "MACs"

Weak MAC algorithms:

hmac-md5
hmac-md5-96
hmac-ripemd160
hmac-sha1
hmac-sha1-96
umac-64@openssh.com
umac-128@openssh.com
hmac-md5-etm@openssh.com
hmac-md5-96-etm@openssh.com
hmac-ripemd160-etm@openssh.com
hmac-sha1-etm@openssh.com
hmac-sha1-96-etm@openssh.com
umac-64-etm@openssh.com
umac-128-etm@openssh.com

Expected Result

Output should not contain any of the listed weak MAC algorithms.

Remediation

Edit the /etc/ssh/sshd_config file and add/modify the MACs line to contain a comma separated list of the site approved MACs. Example:

MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256

Default Value

macs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1

References

More information on SSH downgrade attacks can be found here: http://www.mitls.org/pages/attacks/SLOTH
SSHD_CONFIG(5)

Additional Information

Some organizations may have stricter requirements for approved MACs. Ensure that MACs used are in compliance with site policy.

The only "strong" MACs currently FIPS 140-2 approved are hmac-sha2-256 and hmac-sha2-512.

The Supported MACs are:

hmac-md5
hmac-md5-96
hmac-ripemd160
hmac-sha1
hmac-sha1-96
hmac-sha2-256
hmac-sha2-512
umac-64@openssh.com
umac-128@openssh.com
hmac-md5-etm@openssh.com
hmac-md5-96-etm@openssh.com
hmac-ripemd160-etm@openssh.com
hmac-sha1-etm@openssh.com
hmac-sha1-96-etm@openssh.com
hmac-sha2-256-etm@openssh.com
hmac-sha2-512-etm@openssh.com
umac-64-etm@openssh.com
umac-128-etm@openssh.com

CIS Controls

Controls Version	Control	IG 2	IG 3
v8	3.10 Encrypt Sensitive Data in Transit	x	x
v7	14.4 Encrypt All Sensitive Information in Transit	x	x
v7	16.5 Encrypt Transmittal of Username and Authentication Credentials	x	x

Profile

Level 2 - Server

---name: cis-gcp-cos-5-1-14description: Ensure only strong MAC algorithms are used---# 5.1.14 Ensure only strong MAC algorithms are used (Automated)## DescriptionThis variable limits the types of MAC algorithms that SSH can use during communication.## RationaleMD5 and 96-bit MAC algorithms are considered weak and have been shown to increase exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of attention as a weak spot that can be exploited with expanded computing power. An attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the SSH tunnel and capture credentials and information.## Audit ProcedureRun the following command and verify that output does not contain any of the listed weak MAC algorithms:```bash# sshd -T | grep -i "MACs"```Weak MAC algorithms:```hmac-md5hmac-md5-96hmac-ripemd160hmac-sha1hmac-sha1-96umac-64@openssh.comumac-128@openssh.comhmac-md5-etm@openssh.comhmac-md5-96-etm@openssh.comhmac-ripemd160-etm@openssh.comhmac-sha1-etm@openssh.comhmac-sha1-96-etm@openssh.comumac-64-etm@openssh.comumac-128-etm@openssh.com```## Expected ResultOutput should not contain any of the listed weak MAC algorithms.## RemediationEdit the `/etc/ssh/sshd_config` file and add/modify the MACs line to contain a comma separated list of the site approved MACs. Example:```MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256```## Default Valuemacs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1## References1. More information on SSH downgrade attacks can be found here: http://www.mitls.org/pages/attacks/SLOTH2. SSHD_CONFIG(5)## Additional InformationSome organizations may have stricter requirements for approved MACs. Ensure that MACs used are in compliance with site policy.The only "strong" MACs currently FIPS 140-2 approved are hmac-sha2-256 and hmac-sha2-512.The Supported MACs are:```hmac-md5hmac-md5-96hmac-ripemd160hmac-sha1hmac-sha1-96hmac-sha2-256hmac-sha2-512umac-64@openssh.comumac-128@openssh.comhmac-md5-etm@openssh.comhmac-md5-96-etm@openssh.comhmac-ripemd160-etm@openssh.comhmac-sha1-etm@openssh.comhmac-sha1-96-etm@openssh.comhmac-sha2-256-etm@openssh.comhmac-sha2-512-etm@openssh.comumac-64-etm@openssh.comumac-128-etm@openssh.com```## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | ------------------------------------------------------------------- | ---- | ---- | ---- || v8 | 3.10 Encrypt Sensitive Data in Transit | | x | x || v7 | 14.4 Encrypt All Sensitive Information in Transit | | x | x || v7 | 16.5 Encrypt Transmittal of Username and Authentication Credentials | | x | x |## Profile- Level 2 - Server

Frequently asked questions

Cis GCP Cos 5.1.14