Ensure sshd Ciphers are configured

보통레벨 1자동linux

설명

Secure Shell (SSH) ciphers are encryption algorithms used by the SSH protocol to secure data transmitted between a client and a server. They protect the privacy and integrity of the connection, using symmetric encryption to encrypt data after a secure session is established. During connection setup, the client and server negotiate to select the strongest available cipher that both support, ensuring the connection is as secure as possible More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

점검 방법

감사 방식: 셸 명령

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash
{
   a_weak=(3des-cbc blowfish-cbc cast128-cbc aes128-cbc aes192-cbc aes256-cbc arcfour arcfour128 arcfour256 rijndael-cbc@lysator.liu.se)
   l_offered="$(sshd -T | awk '"'"'$1=="ciphers"{print $2}'"'"' | tr '"'"','"'"' '"'"'\n'"'"')"
   for l_alg in "${a_weak[@]}"; do
      grep -Fxq -- "$l_alg" <<< "$l_offered" && printf '"'"'%s\n'"'"' "$l_alg"
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; o=$(bash -c 'sshd -T 2>&1 | awk '"'"'($1=="ciphers" && $2~/chacha20- poly1305@openssh\.com/){print}'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'On OpenSSH 9.6 and later the Terrapin attack (CVE-2023-48795) is mitigated by' || { echo step2: missing 'On OpenSSH 9.6 and later the Terrapin attack (CVE-2023-48795'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'default through strict key exchange, so a returned line does not by itself indicate a' || { echo step2: missing 'default through strict key exchange, so a returned line does'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'weakness. On earlier OpenSSH releases, if a line is returned, review CVE-2023-48795' || { echo step2: missing 'weakness. On earlier OpenSSH releases, if a line is returned'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'and verify the system has been patched, and consider excluding chacha20-poly1305' || { echo step2: missing 'and verify the system has been patched, and consider excludi'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'through the system-wide crypto policy.' || { echo step2: missing 'through the system-wide crypto policy.'; return 1; }; }; if alt0; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

The ciphers available to the SSH server are governed by the system-wide crypto policy. Disable the weak ciphers by configuring the system-wide crypto policy as described in the "Configure system wide crypto policy" section. - IF - CVE-2023-48795 (Terrapin) has not been reviewed and addressed, chacha20- poly1305 should also be disabled through the system-wide crypto policy. Once the crypto policy has been updated, reload the SSH daemon: # systemctl reload-or-restart sshd

속성

운영 체제: almalinux-9
태그: cis-convertedlinux
참고 자료: CIS AlmaLinux OS 9 Benchmark v3.0.0 - 5.1.5

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux