Ensure sshd KexAlgorithms is configured

ÉlevéeNiveau 1Automatiséefreebsd

Description

Key exchange is any cryptography method that exchanges cryptographic keys between two parties, allowing the use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received. Key exchange methods that are considered weak should be removed. A key exchange method may be weak because too few bits are used or the hashing algorithm is considered too weak. Using weak algorithms could expose connections to man-in-the- middle attacks. Audit: the effective `kexalgorithms` list from `sshd -T` must not contain any weak algorithm listed by CIS.

Méthode de vérification

Méthode d'audit: Commande shell

shell

command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; line=$(printf '%s\n' "$out" | grep -i '^kexalgorithms '); [ -n "$line" ] || exit 1; printf '%s\n' "$line" | grep -Eiq -- '(^|[ ,])(diffie-hellman-group1-sha1|diffie-hellman-group14-sha1|diffie-hellman-group-exchange-sha1)(,|$)' && echo "weak: $line" || echo compliant

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Edit the /etc/ssh/sshd_config file and add/modify the KexAlgorithms line to contain a comma-separated list of the site unapproved (weak) KexAlgorithms preceded with a - above any Include entries: Example: KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie- hellman-group-exchange-sha1

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: freebsdssh
Référence: CIS FreeBSD 14 Benchmark v1.0.1 - 4.2.11 Ensure sshd KexAlgorithms is configured

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target freebsd