Ensure sshd KexAlgorithms is configured

AltaNivel 1Automatizadafreebsd

Descripción

Key exchange is any cryptography method that exchanges cryptographic keys between two parties, allowing the use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received. Key exchange methods that are considered weak should be removed. A key exchange method may be weak because too few bits are used or the hashing algorithm is considered too weak. Using weak algorithms could expose connections to man-in-the- middle attacks. Audit: the effective `kexalgorithms` list from `sshd -T` must not contain any weak algorithm listed by CIS.

Cómo se verifica

Método de auditoría: Comando de shell

shell

command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; line=$(printf '%s\n' "$out" | grep -i '^kexalgorithms '); [ -n "$line" ] || exit 1; printf '%s\n' "$line" | grep -Eiq -- '(^|[ ,])(diffie-hellman-group1-sha1|diffie-hellman-group14-sha1|diffie-hellman-group-exchange-sha1)(,|$)' && echo "weak: $line" || echo compliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Edit the /etc/ssh/sshd_config file and add/modify the KexAlgorithms line to contain a comma-separated list of the site unapproved (weak) KexAlgorithms preceded with a - above any Include entries: Example: KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie- hellman-group-exchange-sha1

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: freebsdssh
Referencia: CIS FreeBSD 14 Benchmark v1.0.1 - 4.2.11 Ensure sshd KexAlgorithms is configured

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target freebsd