Ensure sshd KexAlgorithms is configured

MediumLevel 1Automatedlinux

Description

Key exchange is any method in cryptography by which cryptographic keys are exchanged between two parties, allowing use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received Notes: • Kex algorithms have a higher preference the earlier they appear in the list • Some organizations may have stricter requirements for approved Key exchange algorithms • Ensure that Key exchange algorithms used are in compliance with site policy • The only Key Exchange Algorithms currently FIPS 14

How it is checked

Audit method: Shell command

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash
{
   a_weak=(diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie- hellman-group-exchange-sha1)
   l_offered="$(sshd -T | awk '"'"'$1=="kexalgorithms"{print $2}'"'"' | tr '"'"','"'"' '"'"'\n'"'"')"
   for l_alg in "${a_weak[@]}"; do
      grep -Fxq -- "$l_alg" <<< "$l_offered" && printf '"'"'%s\n'"'"' "$l_alg"
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

The key exchange algorithms available to the SSH server are governed by the system- wide crypto policy. The weak key exchange algorithms in scope are SHA1-based; disable them by disabling SHA1 hash and signature support in the system-wide crypto policy as described in the "Configure system wide crypto policy" section. Once the crypto policy has been updated, reload the SSH daemon: # systemctl reload-or-restart sshd

Properties

Operating systems: almalinux-9
Tags: cis-convertedlinux
Reference: CIS AlmaLinux OS 9 Benchmark v3.0.0 - 5.1.6

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target linux