Ensure sshd KexAlgorithms is configured

HochStufe 1Automatisiertfreebsd

Beschreibung

Key exchange is any cryptography method that exchanges cryptographic keys between two parties, allowing the use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received. Key exchange methods that are considered weak should be removed. A key exchange method may be weak because too few bits are used or the hashing algorithm is considered too weak. Using weak algorithms could expose connections to man-in-the- middle attacks. Audit: the effective `kexalgorithms` list from `sshd -T` must not contain any weak algorithm listed by CIS.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; line=$(printf '%s\n' "$out" | grep -i '^kexalgorithms '); [ -n "$line" ] || exit 1; printf '%s\n' "$line" | grep -Eiq -- '(^|[ ,])(diffie-hellman-group1-sha1|diffie-hellman-group14-sha1|diffie-hellman-group-exchange-sha1)(,|$)' && echo "weak: $line" || echo compliant

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Edit the /etc/ssh/sshd_config file and add/modify the KexAlgorithms line to contain a comma-separated list of the site unapproved (weak) KexAlgorithms preceded with a - above any Include entries: Example: KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie- hellman-group-exchange-sha1

Eigenschaften

Betriebssysteme: Beliebig
Tags: freebsdssh
Referenz: CIS FreeBSD 14 Benchmark v1.0.1 - 4.2.11 Ensure sshd KexAlgorithms is configured

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target freebsd