diff --git a/Dockerfiles/test_suite-sle15 b/Dockerfiles/test_suite-sle15
index 56067151ba0e..071625e5415f 100644
--- a/Dockerfiles/test_suite-sle15
+++ b/Dockerfiles/test_suite-sle15
@@ -5,7 +5,7 @@ ENV AUTH_KEYS=/root/.ssh/authorized_keys
 ARG CLIENT_PUBLIC_KEY
 ARG ADDITIONAL_PACKAGES
 
-RUN zypper ar --no-gpgcheck http://download.opensuse.org/distribution/leap/15.5/repo/oss/ oss
+RUN zypper ar --no-gpgcheck http://download.opensuse.org/distribution/leap/15.6/repo/oss/ oss
 RUN zypper refresh
 
 RUN true \
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/ansible/shared.yml
index 9c5892fcda67..b19325ff5cbe 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/ansible/shared.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/ansible/shared.yml
@@ -5,4 +5,28 @@
 # disruption = low
 {{{ ansible_instantiate_variables("sshd_approved_ciphers") }}}
 
-{{{ ansible_sshd_set(parameter="Ciphers", value="{{ sshd_approved_ciphers }}", rule_title=rule_title) }}}
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+{{{ ansible_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file, rule_title=rule_title) }}}
+- name: Check if SSH {{{ sshd_main_config_file }}} configuration file exists
+  ansible.builtin.stat:
+    path: {{{ sshd_main_config_file }}}
+  register: sshd_main_config_file_{{{ rule_id }}}
+{{{
+    ansible_lineinfile(
+        rule_title + ' - Remove /usr/etc/ssh/sshd_config.d/*.conf include directive from ' + sshd_main_config_file,
+        path=sshd_main_config_file,
+        regex='^\s*Include\s+\/usr\/etc\/ssh\/sshd_config\.d/\*\.conf',
+        state='absent',
+        when='sshd_main_config_file_' + rule_id + '.stat.exists'
+    )
+}}}
+{{% endif %}}
+
+{{{
+    ansible_sshd_set(
+        parameter="Ciphers",
+        value="{{ sshd_approved_ciphers }}",
+        config_is_distributed=sshd_distributed_config,
+        rule_title=rule_title
+    )
+}}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/bash/shared.sh
index 0c9d1b452478..e966bf8ebcb3 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/bash/shared.sh
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/bash/shared.sh
@@ -2,8 +2,14 @@
 
 {{{ bash_instantiate_variables("sshd_approved_ciphers") }}}
 
+{{% if product in ['sle16', 'slmicro6'] %}}
+    {{{ bash_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file) }}}
+    {{{ lineinfile_absent(sshd_main_config_file, "^\s*Include\s*/usr/etc/ssh/sshd_config\.d/\*\.conf", sed_path_separator="#", rule_id=rule_id) }}}
+{{% endif %}}
+
 {{{ bash_sshd_remediation(
     parameter="Ciphers",
     value="$sshd_approved_ciphers",
     config_is_distributed=sshd_distributed_config,
-    rule_id=rule_id) }}}
+    rule_id=rule_id)
+}}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/oval/shared.xml
index 52ca8097c258..dc64d5156a6d 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/oval/shared.xml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/oval/shared.xml
@@ -1,4 +1,5 @@
 {{%- set sshd_main_config = sshd_main_config_file -%}}
+{{%- set sshd_drop_in_dir = sshd_config_dir -%}}
 <def-group>
   <definition class="compliance" id="sshd_use_approved_ciphers" version="1">
     {{{ oval_metadata("Limit the ciphers to those which are FIPS-approved.", rule_title=rule_title) }}}
@@ -15,14 +16,29 @@
         definition_ref="sshd_required_or_unset" />
         <extend_definition comment="rpm package openssh-server installed"
         definition_ref="package_openssh-server_installed" />
-        <criterion comment="Check the Ciphers list in /etc/ssh/sshd_config"
+        {{% if product in [ 'sle16', 'slmicro6' ] %}}
+        <criterion comment="test if SSH main configuration {{{ sshd_main_config }}} exists for {{{ rule_id }}}"
+            test_ref="test_{{{ rule_id }}}_config_file_exists"/>
+        {{% endif %}}
+        <criterion comment="Check the Ciphers list in {{{ sshd_main_config }}}"
         test_ref="test_sshd_use_approved_ciphers" />
+        {{%- if sshd_distributed_config == "true" %}}
+        <criterion comment="Check the Ciphers list in {{{ sshd_config_dir }}}"
+            test_ref="test_sshd_use_approved_ciphers_config_dir" />
+        {{%- endif %}}
+        <criterion comment="the configuration exists"
+            test_ref="test_sshd_ciphers_exists" />
       </criteria>
     </criteria>
   </definition>
 
-  <ind:variable_test check="all" check_existence="all_exist"
-  comment="tests the value of Ciphers setting in the /etc/ssh/sshd_config file"
+  {{% if product in [ 'sle16', 'slmicro6' ] %}}
+  {{{ oval_config_file_exists_test(sshd_main_config, rule_id=rule_id) }}}
+  {{{ oval_config_file_exists_object(sshd_main_config, rule_id=rule_id) }}}
+  {{% endif %}}
+
+  <ind:variable_test check="all" check_existence="any_exist"
+  comment="tests the value of Ciphers setting in the {{{ sshd_main_config }}} file"
   id="test_sshd_use_approved_ciphers" version="1">
     <ind:object object_ref="obj_sshd_use_approved_ciphers" />
     <ind:state state_ref="ste_sshd_use_approved_ciphers" />
@@ -32,8 +48,8 @@
     <ind:var_ref>var_sshd_config_ciphers</ind:var_ref>
   </ind:variable_object>
 
-  <ind:variable_state comment="approved ciphers" id="ste_sshd_use_approved_ciphers" version="1">
-    <ind:value operation="equals" datatype="string" var_ref="var_sshd_approved_ciphers" var_check="at least one" />
+  <ind:variable_state comment="approved ciphers list" id="ste_sshd_use_approved_ciphers" version="1">
+    <ind:value operation="equals" datatype="string" var_ref="var_sshd_approved_ciphers" var_check="at least one"/>
   </ind:variable_state>
 
   <ind:textfilecontent54_object id="obj_sshd_config_ciphers" version="1">
@@ -48,6 +64,50 @@
     </split>
   </local_variable>
 
+  {{%- if sshd_distributed_config == "true" %}}
+  <ind:variable_test check="all" check_existence="any_exist"
+  comment="tests the value of Ciphers setting in {{{ sshd_drop_in_dir }}}"
+  id="test_sshd_use_approved_ciphers_config_dir" version="1">
+    <ind:object object_ref="obj_sshd_use_approved_ciphers_config_dir" />
+    <ind:state state_ref="ste_sshd_use_approved_ciphers_config_dir" />
+  </ind:variable_test>
+
+  <ind:variable_object id="obj_sshd_use_approved_ciphers_config_dir" version="1">
+    <ind:var_ref>var_sshd_config_ciphers_config_dir</ind:var_ref>
+  </ind:variable_object>
+
+  <ind:variable_state comment="approved ciphers list" id="ste_sshd_use_approved_ciphers_config_dir" version="1">
+    <ind:value operation="equals" datatype="string" var_ref="var_sshd_approved_ciphers" var_check="at least one" />
+  </ind:variable_state>
+
+  <ind:textfilecontent54_object id="obj_sshd_config_ciphers_config_dir" version="1">
+    <ind:path>{{{ sshd_drop_in_dir }}}</ind:path>
+    <ind:filename operation="pattern match">.*\.conf$</ind:filename>
+    <ind:pattern operation="pattern match">^[\s]*(?i)Ciphers(?-i)[\s]+([\w,-@]+)+[\s]*(?:#.*)?$</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <local_variable id="var_sshd_config_ciphers_config_dir" datatype="string" version="1" comment="Ciphers values split on comma">
+    <split delimiter=",">
+      <object_component item_field="subexpression" object_ref="obj_sshd_config_ciphers_config_dir" />
+    </split>
+  </local_variable>
+  {{%- endif %}}
+
+  <ind:textfilecontent54_test id="test_sshd_ciphers_exists" version="1" check="all" check_existence="at_least_one_exists"
+    comment="Verify that the value of Ciphers is present">
+    <ind:object object_ref="obj_sshd_ciphers_all_configs" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object comment="All confs collection" id="obj_sshd_ciphers_all_configs" version="1">
+    <set>
+      <object_reference>obj_sshd_config_ciphers</object_reference>
+      {{% if sshd_distributed_config == "true" %}}
+      <object_reference>obj_sshd_config_ciphers_config_dir</object_reference>
+      {{% endif %}}
+    </set>
+  </ind:textfilecontent54_object>
+
   <local_variable id="var_sshd_approved_ciphers" datatype="string" version="1" comment="approved ciphers values split on comma">
     <split delimiter=",">
       <variable_component var_ref="sshd_approved_ciphers" />
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_reduced_list_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_reduced_list_config_dir.pass.sh
new file mode 100644
index 000000000000..0a25871b380a
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_reduced_list_config_dir.pass.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+{{% if sshd_distributed_config == "false" %}}
+# platform = Not Applicable
+{{% else %}}
+# platform = multi_platform_sle
+{{% endif %}}
+
+source include.sh
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+touch "{{{ sshd_main_config_file }}}"
+{{% endif %}}
+
+echo 'Ciphers aes128-ctr,aes192-ctr' >> "{{{ sshd_config_dir }}}/00-test.conf"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_value_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_value_config_dir.pass.sh
new file mode 100644
index 000000000000..9d41bd64569e
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_value_config_dir.pass.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+{{% if sshd_distributed_config == "false" %}}
+# platform = Not Applicable
+{{% else %}}
+# platform = multi_platform_sle
+{{% endif %}}
+
+source include.sh
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+touch "{{{ sshd_main_config_file }}}"
+{{% endif %}}
+echo 'Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc,rijndael-cbc@lysator.liu.se' >> "{{{ sshd_config_dir }}}/00-test.conf"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_variable_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_variable_config_dir.pass.sh
new file mode 100644
index 000000000000..1f879d5fcc97
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_variable_config_dir.pass.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+{{% if sshd_distributed_config == "false" %}}
+# platform = Not Applicable
+{{% else %}}
+# platform = multi_platform_sle
+{{% endif %}}
+# variables = sshd_approved_ciphers=ijkl158,sits,wwq-98,kl24
+
+source include.sh
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+touch "{{{ sshd_main_config_file }}}"
+{{% endif %}}
+
+echo 'Ciphers ijkl158,sits,wwq-98,kl24' >> "{{{ sshd_config_dir }}}/00-test.conf"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/include.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/include.sh
new file mode 100644
index 000000000000..f0c38e18588b
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/include.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+declare -a SSHD_PATHS=({{{ sshd_main_config_file }}})
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+SSHD_PATHS+=({{{ sshd_config_dir }}}/*)
+{{% endif %}}
+# clean up configurations
+sed -i '/^Ciphers.*/d' "${SSHD_PATHS[@]}"
+
+# restore to defaults for sle16 and slmicro6
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+if [ -e "{{{ sshd_main_config_file }}}" ] ; then
+    rm "{{{ sshd_main_config_file }}}"
+fi
+{{% endif %}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/wrong_value_conifg_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/wrong_value_conifg_dir.fail.sh
new file mode 100644
index 000000000000..ec59cfc3f0ee
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/wrong_value_conifg_dir.fail.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+{{% if sshd_distributed_config == "false" %}}
+# platform = Not Applicable
+{{% else %}}
+# platform = multi_platform_sle
+{{% endif %}}
+
+source include.sh
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+touch "{{{ sshd_main_config_file }}}"
+{{% endif %}}
+echo 'Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc,rijndael-cbc@lysator.liu.se' >> {{{ sshd_main_config_file }}}
+echo 'Ciphers weak-cipher' >> "{{{ sshd_config_dir }}}/00-test.conf"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/ansible/shared.yml
index c642d4c55fb4..d6e27e7aed3f 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/ansible/shared.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/ansible/shared.yml
@@ -8,5 +8,21 @@
 {{{ ansible_instantiate_variables('sshd_approved_ciphers') }}}
 {{{ ansible_sshd_set(parameter="Ciphers", value="{{ sshd_approved_ciphers }}", config_is_distributed=sshd_distributed_config, rule_title=rule_title) }}}
 {{%- else %}}
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+{{{ ansible_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file, rule_title=rule_title) }}}
+- name: Check if SSH {{{ sshd_main_config_file }}} configuration file exists
+  ansible.builtin.stat:
+    path: {{{ sshd_main_config_file }}}
+  register: sshd_main_config_file_{{{ rule_id }}}
+{{{
+    ansible_lineinfile(
+        rule_title + ' - Remove /usr/etc/ssh/sshd_config.d/*.conf include directive from ' + sshd_main_config_file,
+        path=sshd_main_config_file,
+        regex='^\s*Include\s+\/usr\/etc\/ssh\/sshd_config\.d/\*\.conf',
+        state='absent',
+        when='sshd_main_config_file_' + rule_id + '.stat.exists'
+    )
+}}}
+{{% endif %}}
 {{{ ansible_sshd_set(parameter="Ciphers", value="aes256-ctr,aes192-ctr,aes128-ctr", config_is_distributed=sshd_distributed_config, rule_title=rule_title) }}}
 {{%- endif %}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/bash/shared.sh
index cedc3c42510b..317f7437b305 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/bash/shared.sh
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/bash/shared.sh
@@ -1,5 +1,10 @@
 # platform = Oracle Linux 7,multi_platform_sle,multi_platform_slmicro
 
+{{% if product in ['sle16', 'slmicro6'] %}}
+    {{{ bash_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file) }}}
+    {{{ lineinfile_absent(sshd_main_config_file, "^\s*Include\s*/usr/etc/ssh/sshd_config\.d/\*\.conf", sed_path_separator="#", rule_id=rule_id) }}}
+{{% endif %}}
+
 {{{ bash_sshd_remediation(
     parameter="Ciphers",
     value="aes256-ctr,aes192-ctr,aes128-ctr",
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml
index 452e2c8e1d0f..4c6cb59d92fb 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml
@@ -1,36 +1,95 @@
 {{%- set sshd_main_config = sshd_main_config_file -%}}
+{{%- set sshd_drop_in_dir = sshd_config_dir -%}}
+{{% set sufix_conf="(\s.*)?" %}}
+{{% set prefix_conf="^\s*Ciphers\s*" %}}
+{{% set ciphers=["aes256-ctr","aes192-ctr","aes128-ctr"] %}}
+{{% set ciphers_regex=prefix_conf ~ "(?=[\w-])" "(\\b" ~ ciphers|join("\\b,?)?(\\b") ~ ")?" ~ sufix_conf ~ "[\\s]*(?:#.*)?$" %}}
 <def-group>
-  <definition class="compliance" id="sshd_use_approved_ciphers_ordered_stig" version="1">
+  <definition class="compliance" id="{{{ rule_id }}}" version="1">
     {{{ oval_metadata("Limit the ciphers to those which are FIPS-approved.", rule_title=rule_title) }}}
-    <criteria comment="SSH is configured correctly or is not installed"
-    operator="OR">
+    <criteria comment="sshd is configured correctly or is not installed" operator="OR">
       <criteria comment="sshd is not installed" operator="AND">
         <extend_definition comment="sshd is not required or requirement is unset"
-        definition_ref="sshd_not_required_or_unset" />
-        <extend_definition comment="rpm package openssh-server removed"
-        definition_ref="package_openssh-server_removed" />
+          definition_ref="sshd_not_required_or_unset" />
+        <extend_definition comment="package openssh-server removed"
+          definition_ref="package_openssh-server_removed" />
       </criteria>
+
       <criteria comment="sshd is installed and configured" operator="AND">
         <extend_definition comment="sshd is required or requirement is unset"
-        definition_ref="sshd_required_or_unset" />
-        <extend_definition comment="rpm package openssh-server installed"
-        definition_ref="package_openssh-server_installed" />
-        <criterion comment="Check the Ciphers list in /etc/ssh/sshd_config"
-        test_ref="test_sshd_use_approved_ciphers_ordered_stig" />
+          definition_ref="sshd_required_or_unset" />
+        <extend_definition comment="package openssh-server installed"
+          definition_ref="package_openssh-server_installed" />
+        <criteria comment="sshd is configured correctly" operator="AND">
+          <criteria comment="the configuration is correct if it exists" operator="AND">
+            {{% if product in [ 'sle16', 'slmicro6' ] %}}
+            <criterion comment="test if SSH main configuration {{{ sshd_main_config }}} exists for {{{ rule_id }}}"
+                test_ref="test_{{{ rule_id }}}_config_file_exists"/>
+            {{% endif %}}
+            <criterion comment="Check the ciphers in {{{ sshd_main_config }}} if any"
+              test_ref="test_{{{ rule_id }}}" />
+            {{%- if sshd_distributed_config == "true" %}}
+            <criterion comment="Check the ciphers in {{{ sshd_drop_in_dir }}} if any"
+              test_ref="test_{{{ rule_id }}}_config_dir" />
+            {{%- endif %}}
+          </criteria>
+          <criterion comment="the configuration exists" test_ref="test_ciphers_present_{{{ rule_id }}}" />
+        </criteria>
       </criteria>
+
     </criteria>
   </definition>
 
-  <ind:textfilecontent54_test check="all" check_existence="all_exist"
-  comment="tests the value of Ciphers setting in the /etc/ssh/sshd_config file"
-  id="test_sshd_use_approved_ciphers_ordered_stig" version="1">
-    <ind:object object_ref="obj_sshd_use_approved_ciphers_ordered_stig" />
+  {{% if product in [ 'sle16', 'slmicro6' ] %}}
+  {{{ oval_config_file_exists_test(sshd_main_config, rule_id=rule_id) }}}
+  {{{ oval_config_file_exists_object(sshd_main_config, rule_id=rule_id) }}}
+  {{% endif %}}
+  <ind:textfilecontent54_test check="all" check_existence="any_exist"
+    comment="tests the value of ciphers setting in the {{{ sshd_main_config }}} file"
+    id="test_{{{ rule_id }}}" version="1">
+    <ind:object object_ref="obj_{{{ rule_id }}}" />
+    <ind:state state_ref="state_{{{ rule_id }}}" />
   </ind:textfilecontent54_test>
 
-  <ind:textfilecontent54_object id="obj_sshd_use_approved_ciphers_ordered_stig" version="1">
+  <ind:textfilecontent54_state id="state_{{{ rule_id }}}" version="1">
+    <ind:text operation="pattern match">{{{ ciphers_regex }}}</ind:text>
+  </ind:textfilecontent54_state>
+
+  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}" version="1">
     <ind:filepath>{{{ sshd_main_config }}}</ind:filepath>
-    <ind:pattern operation="pattern match">^[\s]*(?i)Ciphers(?-i)[\s]+(?=[\w]+)(aes256-ctr(?=[\w,]+|$),?)?(aes192-ctr(?=[\w,]+|$),?)?(aes128-ctr)?[\s]*(?:#.*)?$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
+    <ind:pattern operation="pattern match">{{{ prefix_conf }}}.*</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal" >1</ind:instance>
   </ind:textfilecontent54_object>
 
+  {{%- if sshd_distributed_config == "true" %}}
+  <ind:textfilecontent54_test check="all" check_existence="any_exist"
+    comment="tests the value of ciphers setting in the {{{ sshd_drop_in_dir }}} file"
+    id="test_{{{ rule_id }}}_config_dir" version="1">
+    <ind:object object_ref="obj_{{{ rule_id }}}_config_dir" />
+    <ind:state state_ref="state_{{{ rule_id }}}" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}_config_dir" version="1">
+    <ind:path>{{{ sshd_drop_in_dir }}}</ind:path>
+    <ind:filename operation="pattern match">.*\.conf$</ind:filename>
+    <ind:pattern operation="pattern match">{{{ prefix_conf }}}.*</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal" >1</ind:instance>
+  </ind:textfilecontent54_object>
+  {{%- endif %}}
+
+  <ind:textfilecontent54_object comment="All confs collection" id="obj_collection_obj_{{{ rule_id }}}" version="1">
+    <set>
+      <object_reference>obj_{{{ rule_id }}}</object_reference>
+      {{% if sshd_distributed_config == "true" %}}
+      <object_reference>obj_{{{ rule_id }}}_config_dir</object_reference>
+      {{% endif %}}
+    </set>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test id="test_ciphers_present_{{{ rule_id }}}" version="1"
+                              check="all" check_existence="at_least_one_exists"
+                              comment="Verify that the value of ciphers is present">
+    <ind:object object_ref="obj_collection_obj_{{{ rule_id }}}" />
+  </ind:textfilecontent54_test>
+
 </def-group>
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value.pass.sh
index 336bbf06eb0e..a4595eb09de4 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value.pass.sh
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value.pass.sh
@@ -2,4 +2,4 @@
 
 source common.sh
 
-echo "ciphers $sshd_approved_ciphers" >> /etc/ssh/sshd_config
+echo "Ciphers $sshd_approved_ciphers" >> /etc/ssh/sshd_config
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value_config_dir.pass.sh
new file mode 100644
index 000000000000..3fe6442102cd
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value_config_dir.pass.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+source common.sh
+
+echo "Ciphers $sshd_approved_ciphers" >> "{{{ sshd_config_dir }}}/00-test.conf"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_config_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_config_dir.fail.sh
new file mode 100644
index 000000000000..b7152191b8cf
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_config_dir.fail.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+source common.sh
+
+echo "Ciphers $sshd_approved_ciphers,weak-cipher" >> "{{{ sshd_config_dir }}}/00-test.conf"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh
new file mode 100644
index 000000000000..722bbae9aa91
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# platform = multi_platform_sle
+source common.sh
+
+echo "Ciphers $sshd_approved_ciphers" >> "{{{ sshd_config_dir }}}/00-test.conf"
+echo "Ciphers weak-cipher" >> "{{{ sshd_config_dir }}}/01-test.conf"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_times.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_times.fail.sh
new file mode 100644
index 000000000000..abe9a4caf115
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_times.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# platform = multi_platform_sle
+source common.sh
+
+echo "Ciphers $sshd_approved_ciphers" >> "{{{ sshd_main_config_file }}}"
+echo "Ciphers weak-cipher" >> "{{{ sshd_main_config_file }}}"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/ansible/shared.yml
index e3648f27db61..fa0982687018 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/ansible/shared.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/ansible/shared.yml
@@ -5,4 +5,21 @@
 # disruption = low
 {{{ ansible_instantiate_variables("sshd_approved_macs") }}}
 
-{{{ ansible_sshd_set(parameter="MACs", value="{{ sshd_approved_macs }}", rule_title=rule_title) }}}
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+{{{ ansible_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file, rule_title=rule_title) }}}
+- name: Check if SSH {{{ sshd_main_config_file }}} configuration file exists
+  ansible.builtin.stat:
+    path: {{{ sshd_main_config_file }}}
+  register: sshd_main_config_file_{{{ rule_id }}}
+{{{
+    ansible_lineinfile(
+        rule_title + ' - Remove /usr/etc/ssh/sshd_config.d/*.conf include directive from ' + sshd_main_config_file,
+        path=sshd_main_config_file,
+        regex='^\s*Include\s+\/usr\/etc\/ssh\/sshd_config\.d/\*\.conf',
+        state='absent',
+        when='sshd_main_config_file_' + rule_id + '.stat.exists'
+    )
+}}}
+{{% endif %}}
+
+{{{ ansible_sshd_set(parameter="MACs", value="{{ sshd_approved_macs }}", config_is_distributed=sshd_distributed_config, rule_title=rule_title) }}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/bash/shared.sh
index 6eee376dbf96..584aef7c4a42 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/bash/shared.sh
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/bash/shared.sh
@@ -2,6 +2,11 @@
 
 {{{ bash_instantiate_variables("sshd_approved_macs") }}}
 
+{{% if product in ['sle16', 'slmicro6'] %}}
+    {{{ bash_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file) }}}
+    {{{ lineinfile_absent(sshd_main_config_file, "^\s*Include\s*/usr/etc/ssh/sshd_config\.d/\*\.conf", sed_path_separator="#", rule_id=rule_id) }}}
+{{% endif %}}
+
 {{{ bash_sshd_remediation(
     parameter="MACs",
     value="$sshd_approved_macs",
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/oval/shared.xml
index ce8530423105..64f074c12a16 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/oval/shared.xml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/oval/shared.xml
@@ -1,4 +1,5 @@
 {{%- set sshd_main_config = sshd_main_config_file -%}}
+{{%- set sshd_drop_in_dir = sshd_config_dir -%}}
 <def-group>
   <definition class="compliance" id="sshd_use_approved_macs" version="1">
     {{{ oval_metadata("Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.", rule_title=rule_title) }}}
@@ -25,45 +26,110 @@
         <extend_definition comment="rpm package openssh-server installed"
         definition_ref="package_openssh-server_installed" />
         {{% endif %}}
-        <criterion comment="Check MACs in /etc/ssh/sshd_config"
+        {{% if product in [ 'sle16', 'slmicro6' ] %}}
+        <criterion comment="test if SSH main configuration {{{ sshd_main_config }}} exists for {{{ rule_id }}}"
+            test_ref="test_{{{ rule_id }}}_config_file_exists"/>
+        {{% endif %}}
+        <criterion comment="Check the MACs list in {{{ sshd_main_config }}}"
         test_ref="test_sshd_use_approved_macs" />
+        {{%- if sshd_distributed_config == "true" %}}
+        <criterion comment="Check the MACs list in {{{ sshd_drop_in_dir }}}"
+            test_ref="test_sshd_use_approved_macs_config_dir" />
+        {{%- endif %}}
+        <criterion comment="the configuration exists"
+            test_ref="test_sshd_approved_macs_exists" />
       </criteria>
     </criteria>
   </definition>
 
-  <ind:variable_test check="at least one"
-  comment="tests the value of MACs setting in the /etc/ssh/sshd_config file"
-  id="test_sshd_use_approved_macs" version="1">
+  {{% if product in [ 'sle16', 'slmicro6' ] %}}
+  {{{ oval_config_file_exists_test(sshd_main_config, rule_id=rule_id) }}}
+  {{{ oval_config_file_exists_object(sshd_main_config, rule_id=rule_id) }}}
+  {{% endif %}}
+
+  <ind:variable_test check="all" check_existence="any_exist"
+      id="test_sshd_use_approved_macs" version="1"
+      comment="tests the value of MACs setting in the {{{ sshd_main_config }}} file">
     <ind:object object_ref="obj_sshd_use_approved_macs" />
     <ind:state state_ref="ste_sshd_use_approved_macs" />
   </ind:variable_test>
 
   <ind:variable_object id="obj_sshd_use_approved_macs" version="1">
-    <ind:var_ref>var_sshd_config_macs</ind:var_ref>
+    <ind:var_ref>var_sshd_config_approved_macs</ind:var_ref>
   </ind:variable_object>
 
   <ind:variable_state comment="approved macs" id="ste_sshd_use_approved_macs" version="1">
     <ind:value operation="equals" datatype="string" var_ref="var_sshd_approved_macs" var_check="at least one" />
   </ind:variable_state>
 
-  <ind:textfilecontent54_object id="obj_sshd_config_macs" version="1">
+  <ind:textfilecontent54_object id="obj_sshd_config_approved_macs" version="1">
     <ind:filepath>{{{ sshd_main_config }}}</ind:filepath>
     <ind:pattern operation="pattern match">^[\s]*(?i)MACs(?-i)[\s]+([\w,-@]+)+[\s]*(?:#.*)?$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
-  <local_variable id="var_sshd_config_macs" datatype="string" version="1" comment="MACs values split on comma">
+  <local_variable id="var_sshd_config_approved_macs" datatype="string" version="1"
+      comment="approved MACs values split on comma from main config">
     <split delimiter=",">
-      <object_component item_field="subexpression" object_ref="obj_sshd_config_macs" />
+      <object_component item_field="subexpression" object_ref="obj_sshd_config_approved_macs" />
     </split>
   </local_variable>
 
-  <local_variable id="var_sshd_approved_macs" datatype="string" version="1" comment="approved MACs values split on comma">
+  {{%- if sshd_distributed_config == "true" %}}
+  <ind:variable_test check="all" check_existence="any_exist"
+  comment="tests the value of MACs setting in {{{ sshd_drop_in_dir }}}"
+  id="test_sshd_use_approved_macs_config_dir" version="1">
+    <ind:object object_ref="obj_sshd_use_approved_macs_config_dir" />
+    <ind:state state_ref="ste_sshd_use_approved_macs_config_dir" />
+  </ind:variable_test>
+
+  <ind:variable_object id="obj_sshd_use_approved_macs_config_dir" version="1">
+    <ind:var_ref>var_sshd_config_approved_macs_config_dir</ind:var_ref>
+  </ind:variable_object>
+
+  <ind:variable_state comment="approved MACs list" id="ste_sshd_use_approved_macs_config_dir" version="1">
+    <ind:value operation="equals" datatype="string" var_ref="var_sshd_approved_macs" var_check="at least one" />
+  </ind:variable_state>
+
+  <ind:textfilecontent54_object id="obj_sshd_config_approved_macs_config_dir" version="1">
+    <ind:path>{{{ sshd_drop_in_dir }}}</ind:path>
+    <ind:filename operation="pattern match">.*\.conf$</ind:filename>
+    <ind:pattern operation="pattern match">^[\s]*(?i)MACs(?-i)[\s]+([\w,-@]+)+[\s]*(?:#.*)?$</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <local_variable id="var_sshd_config_approved_macs_config_dir"
+      datatype="string" version="1" comment="MACs values split on comma from drop in configuration">
     <split delimiter=",">
-      <variable_component var_ref="sshd_approved_macs" />
+      <object_component item_field="subexpression" object_ref="obj_sshd_config_approved_macs_config_dir" />
     </split>
   </local_variable>
+  {{%- endif %}}
 
+  <local_variable id="var_sshd_approved_macs"
+      datatype="string"
+      version="1"
+      comment="approved MACs values split on comma">
+    <split delimiter=",">
+      <variable_component var_ref="sshd_approved_macs" />
+    </split>
+  </local_variable>
   <external_variable comment="SSH Approved MACs by FIPS" datatype="string" id="sshd_approved_macs" version="1" />
 
+  <ind:textfilecontent54_test id="test_sshd_approved_macs_exists"
+      version="1" check="all" check_existence="at_least_one_exists"
+      comment="Verify that the value of MACs is present">
+    <ind:object object_ref="obj_sshd_approved_macs_all_configs" />
+  </ind:textfilecontent54_test>
+
+
+  <ind:textfilecontent54_object comment="All confs collection" id="obj_sshd_approved_macs_all_configs" version="1">
+    <set>
+      <object_reference>obj_sshd_config_approved_macs</object_reference>
+      {{% if sshd_distributed_config == "true" %}}
+      <object_reference>obj_sshd_config_approved_macs_config_dir</object_reference>
+      {{% endif %}}
+    </set>
+  </ind:textfilecontent54_object>
+
 </def-group>
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value.pass.sh
new file mode 100644
index 000000000000..080e4934aa60
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value.pass.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# platform = multi_platform_sle
+# variables = sshd_approved_macs=hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
+
+source include.sh
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+touch "{{{ sshd_main_config_file }}}"
+{{% endif %}}
+echo 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256' >> "{{{ sshd_main_config_file }}}"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value_config_dir.pass.sh
new file mode 100644
index 000000000000..cd3ee6b5fb39
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value_config_dir.pass.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+{{% if sshd_distributed_config == "false" %}}
+# platform = Not Applicable
+{{% else %}}
+# platform = multi_platform_sle
+{{% endif %}}
+# variables = sshd_approved_macs=hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
+
+source include.sh
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+touch "{{{ sshd_main_config_file }}}"
+{{% endif %}}
+echo 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256' >> "{{{ sshd_config_dir }}}/00-test.conf"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/include.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/include.sh
new file mode 100644
index 000000000000..0bdac5e3dcd7
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/include.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+declare -a SSHD_PATHS=({{{ sshd_main_config_file }}})
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+SSHD_PATHS+=({{{ sshd_config_dir }}}/*)
+{{% endif %}}
+# clean up configurations
+sed -i '/^MACs.*/d' "${SSHD_PATHS[@]}"
+
+# restore to defaults for sle16 and slmicro6
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+if [ -e "{{{ sshd_main_config_file }}}" ] ; then
+    rm "{{{ sshd_main_config_file }}}"
+fi
+{{% endif %}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value.fail.sh
index 905ec3caefda..c898a102d259 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value.fail.sh
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value.fail.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_ol,multi_platform_rhel,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_ol,multi_platform_rhel,multi_platform_sle
 {{% if product == 'rhel8' -%}}
 # remediation = none
 {{%- endif %}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_config_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_config_dir.fail.sh
new file mode 100644
index 000000000000..296c2e51d79c
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_config_dir.fail.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+{{% if sshd_distributed_config == "false" %}}
+# platform = Not Applicable
+{{% else %}}
+# platform = multi_platform_sle
+{{% endif %}}
+# variables = sshd_approved_macs=hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
+
+source include.sh
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+touch "{{{ sshd_main_config_file }}}"
+{{% endif %}}
+echo 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256' >> "{{{ sshd_main_config_file }}}"
+echo 'MACs weak-hmac' >> "{{{ sshd_config_dir }}}/00-test.conf"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_main_correct_config_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_main_correct_config_dir.fail.sh
new file mode 100644
index 000000000000..0d0b5232f815
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_main_correct_config_dir.fail.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+{{% if sshd_distributed_config == "false" %}}
+# platform = Not Applicable
+{{% else %}}
+# platform = multi_platform_sle
+{{% endif %}}
+# variables = sshd_approved_macs=hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
+
+source include.sh
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+touch "{{{ sshd_main_config_file }}}"
+{{% endif %}}
+echo 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256' >> "{{{ sshd_config_dir }}}/00-test.conf"
+echo 'MACs weak-hmac' >> "{{{ sshd_main_config_file }}}"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/ansible/shared.yml
index c3e236f2fcf6..fd1c274660b4 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/ansible/shared.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/ansible/shared.yml
@@ -8,5 +8,21 @@
 {{{ ansible_instantiate_variables('sshd_approved_macs') }}}
 {{{ ansible_sshd_set(parameter="Macs", value="{{ sshd_approved_macs }}", config_is_distributed=sshd_distributed_config, rule_title=rule_title) }}}
 {{%- else %}}
+{{% if product in [ 'sle16', 'slmicro6' ] %}}
+{{{ ansible_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file, rule_title=rule_title) }}}
+- name: Check if SSH {{{ sshd_main_config_file }}} configuration file exists
+  ansible.builtin.stat:
+    path: {{{ sshd_main_config_file }}}
+  register: sshd_main_config_file_{{{ rule_id }}}
+{{{
+    ansible_lineinfile(
+        rule_title + ' - Remove /usr/etc/ssh/sshd_config.d/*.conf include directive from ' + sshd_main_config_file,
+        path=sshd_main_config_file,
+        regex='^\s*Include\s+\/usr\/etc\/ssh\/sshd_config\.d/\*\.conf',
+        state='absent',
+        when='sshd_main_config_file_' + rule_id + '.stat.exists'
+    )
+}}}
+{{% endif %}}
 {{{ ansible_sshd_set(parameter="MACs", value="hmac-sha2-512,hmac-sha2-256", config_is_distributed=sshd_distributed_config, rule_title=rule_title) }}}
 {{%- endif %}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh
index 83cb8cb6e1c9..80d54ba980e8 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh
@@ -1,7 +1,21 @@
-# platform = Oracle Linux 7,multi_platform_sle,multi_platform_slmicro
+# platform = Oracle Linux 7,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu
+
+{{%- if product == 'ubuntu2404' %}}
+sshd_approved_macs="hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256"
+{{%- elif product == 'ubuntu2204' %}}
+sshd_approved_macs="hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-256-etm@openssh.com"
+{{%- else %}}
+sshd_approved_macs="hmac-sha2-512,hmac-sha2-256"
+{{%- endif %}}
+
+{{% if product in ['sle16', 'slmicro6'] %}}
+    {{{ bash_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file) }}}
+    {{{ lineinfile_absent(sshd_main_config_file, "^\s*Include\s*/usr/etc/ssh/sshd_config\.d/\*\.conf", sed_path_separator="#", rule_id=rule_id) }}}
+{{% endif %}}
 
 {{{ bash_sshd_remediation(
     parameter="MACs",
-    value="hmac-sha2-512,hmac-sha2-256",
+    value="$sshd_approved_macs",
     config_is_distributed=sshd_distributed_config,
-    rule_id=rule_id) }}}
+    rule_id=rule_id)
+}}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/ubuntu.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/ubuntu.sh
deleted file mode 100644
index d8c80b2e2147..000000000000
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/ubuntu.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-# platform = multi_platform_ubuntu
-
-{{%- if product == 'ubuntu2404' %}}
-sshd_approved_macs="hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256"
-{{%- elif product == 'ubuntu2204' %}}
-sshd_approved_macs="hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-256-etm@openssh.com"
-{{%- else %}}
-sshd_approved_macs="hmac-sha2-512,hmac-sha2-256"
-{{%- endif %}}
-
-{{{ bash_sshd_remediation(parameter="MACs", value="$sshd_approved_macs", config_is_distributed=sshd_distributed_config, rule_id=rule_id) }}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml
index 158d94d30e2b..632cf6b340bd 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml
@@ -1,4 +1,9 @@
 {{%- set sshd_main_config = sshd_main_config_file -%}}
+{{%- set sshd_drop_in_dir = sshd_config_dir -%}}
+{{% set sufix_conf="(\s.*)?" %}}
+{{% set prefix_conf="^\s*MACs\s*" %}}
+{{% set macs=["hmac-sha2-512","hmac-sha2-256"] %}}
+{{% set macs_regex=prefix_conf ~ "(?=[\w-])" "(\\b" ~ macs|join("\\b,?)?(\\b") ~ ")?" ~ sufix_conf ~ "[\\s]*(?:#.*)?$" %}}
 <def-group>
   <definition class="compliance" id="sshd_use_approved_macs_ordered_stig" version="1">
     {{{ oval_metadata("Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.", rule_title=rule_title) }}}
@@ -15,22 +20,72 @@
         definition_ref="sshd_required_or_unset" />
         <extend_definition comment="rpm package openssh-server installed"
         definition_ref="package_openssh-server_installed" />
-        <criterion comment="Check MACs in /etc/ssh/sshd_config"
+        {{% if product in [ 'sle16', 'slmicro6' ] %}}
+        <criterion comment="test if SSH main configuration {{{ sshd_main_config }}} exists for {{{ rule_id }}}"
+            test_ref="test_{{{ rule_id }}}_config_file_exists"/>
+        {{% endif %}}
+        {{%- if sshd_distributed_config == "true" %}}
+        <criterion comment="Check the MACs list in {{{ sshd_drop_in_dir }}}"
+            test_ref="test_sshd_use_approved_macs_ordered_stig_config_dir" />
+        {{%- endif %}}
+        <criterion comment="Check MACs in {{{ sshd_main_config }}}"
         test_ref="test_sshd_use_approved_macs_ordered_stig" />
+        <criterion comment="the configuration exists"
+            test_ref="test_MACs_present_sshd_use_approved_macs_ordered_stig" />
       </criteria>
     </criteria>
   </definition>
 
-  <ind:textfilecontent54_test check="all" check_existence="all_exist"
-  comment="tests the value of MACs setting in the /etc/ssh/sshd_config file"
+  {{% if product in [ 'sle16', 'slmicro6' ] %}}
+  {{{ oval_config_file_exists_test(sshd_main_config, rule_id=rule_id) }}}
+  {{{ oval_config_file_exists_object(sshd_main_config, rule_id=rule_id) }}}
+  {{% endif %}}
+
+  <ind:textfilecontent54_test check="all" check_existence="any_exist"
+  comment="tests the value of MACs setting in {{{ sshd_main_config }}} config"
   id="test_sshd_use_approved_macs_ordered_stig" version="1">
     <ind:object object_ref="obj_sshd_use_approved_macs_ordered_stig" />
+    <ind:state state_ref="state_sshd_use_approved_macs_ordered_stig" />
   </ind:textfilecontent54_test>
 
+  <ind:textfilecontent54_state id="state_sshd_use_approved_macs_ordered_stig" version="1">
+    <ind:text operation="pattern match">{{{ macs_regex }}}</ind:text>
+  </ind:textfilecontent54_state>
+
   <ind:textfilecontent54_object id="obj_sshd_use_approved_macs_ordered_stig" version="1">
     <ind:filepath>{{{ sshd_main_config }}}</ind:filepath>
-    <ind:pattern operation="pattern match">^[\s]*(?i)MACs(?-i)[\s]+(?=[\w]+)(hmac-sha2-512(?=[\w,]+|$),?)?(hmac-sha2-256)?[\s]*(?:#.*)?$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
+    <ind:pattern operation="pattern match">{{{ prefix_conf }}}.*</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal" >1</ind:instance>
   </ind:textfilecontent54_object>
 
+  {{%- if sshd_distributed_config == "true" %}}
+  <ind:textfilecontent54_test check="all" check_existence="any_exist"
+  comment="tests the value of MACs setting in {{{ sshd_drop_in_dir }}} configs"
+  id="test_sshd_use_approved_macs_ordered_stig_config_dir" version="1">
+    <ind:object object_ref="obj_sshd_use_approved_macs_ordered_stig_config_dir" />
+    <ind:state state_ref="state_sshd_use_approved_macs_ordered_stig" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_sshd_use_approved_macs_ordered_stig_config_dir" version="1">
+    <ind:path>{{{ sshd_drop_in_dir }}}</ind:path>
+    <ind:filename operation="pattern match">.*\.conf$</ind:filename>
+    <ind:pattern operation="pattern match">{{{ prefix_conf }}}.*</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal" >1</ind:instance>
+  </ind:textfilecontent54_object>
+  {{%- endif %}}
+
+  <ind:textfilecontent54_object comment="All confs collection" id="obj_collection_obj_sshd_use_approved_macs_ordered_stig" version="1">
+    <set>
+      <object_reference>obj_sshd_use_approved_macs_ordered_stig</object_reference>
+      {{%- if sshd_distributed_config == "true" %}}
+      <object_reference>obj_sshd_use_approved_macs_ordered_stig_config_dir</object_reference>
+      {{%- endif %}}
+    </set>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test id="test_MACs_present_sshd_use_approved_macs_ordered_stig" version="1"
+                              check="all" check_existence="at_least_one_exists"
+                              comment="Verify that the value of MACs is present">
+    <ind:object object_ref="obj_collection_obj_sshd_use_approved_macs_ordered_stig" />
+  </ind:textfilecontent54_test>
 </def-group>
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_reduced_list_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_reduced_list_config_dir.pass.sh
new file mode 100644
index 000000000000..6e0c0bf3dc8c
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_reduced_list_config_dir.pass.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# platform = multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro,multi_platform_almalinux
+
+source common.sh
+
+echo "MACs hmac-sha2-256" >> /etc/ssh/sshd_config.d/test.conf
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_value_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_value_config_dir.pass.sh
index 37e9c47b57c6..3a1b819cccad 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_value_config_dir.pass.sh
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_value_config_dir.pass.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_ubuntu
+# platform = multi_platform_sle,multi_platform_ubuntu
 
 source common.sh
 
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_config_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_config_dir.fail.sh
new file mode 100644
index 000000000000..03930b0c33d0
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_config_dir.fail.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+source common.sh
+
+echo "MACs ${sshd_approved_macs},weak-hmac" >> /etc/ssh/sshd_config.d/test.conf
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh
new file mode 100644
index 000000000000..00049c971977
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# platform = multi_platform_sle
+source common.sh
+
+echo "MACs ${sshd_approved_macs}" >> /etc/ssh/sshd_config.d/01.conf
+echo "MACs weak-hmac" >> /etc/ssh/sshd_config.d/00.conf
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_times.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_times.fail.sh
new file mode 100644
index 000000000000..8a1ad21a33fd
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_times.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# platform = multi_platform_sle
+source common.sh
+
+echo "MACs ${sshd_approved_macs}" >> /etc/ssh/sshd_config
+echo "MACs weak-hmac" >> /etc/ssh/sshd_config
diff --git a/products/sle16/product.yml b/products/sle16/product.yml
index 7d54fe73c5f7..d38ce86bdaa5 100644
--- a/products/sle16/product.yml
+++ b/products/sle16/product.yml
@@ -47,4 +47,3 @@ journald_conf_dir_path: /etc/systemd/journal.d
 xwindows_packages:
   - xwayland
 
-sshd_main_config_file: /usr/etc/ssh/sshd_config
diff --git a/tests/data/product_stability/sle16.yml b/tests/data/product_stability/sle16.yml
index 19f74d303472..6de569a30a70 100644
--- a/tests/data/product_stability/sle16.yml
+++ b/tests/data/product_stability/sle16.yml
@@ -106,11 +106,11 @@ reference_uris:
 rsyslog_cafile: /etc/pki/tls/cert.pem
 ssh_client_config_dir: /etc/ssh/ssh_config.d
 ssh_client_main_config_file: /etc/ssh/ssh_config
-sshd_config_base_dir: /usr/etc/ssh
+sshd_config_base_dir: /etc/ssh
 sshd_config_dir: /etc/ssh/sshd_config.d
 sshd_distributed_config: 'true'
 sshd_hardening_config_basename: 00-complianceascode-hardening.conf
-sshd_main_config_file: /usr/etc/ssh/sshd_config
+sshd_main_config_file: /etc/ssh/sshd_config
 sshd_runtime_check: 'false'
 sshd_sysconfig_file: /etc/sysconfig/sshd
 sysctl_remediate_drop_in_file: 'true'