Ensure sshd Ciphers are configured

MédiaNível 1Automatizadalinux

Descrição

Secure Shell (SSH) ciphers are encryption algorithms used by the SSH protocol to secure data transmitted between a client and a server. They protect the privacy and integrity of the connection, using symmetric encryption to encrypt data after a secure session is established. During connection setup, the client and server negotiate to select the strongest available cipher that both support, ensuring the connection is as secure as possible More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

Como é verificado

Método de auditoria: Comando shell

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash
{
   a_weak=(3des-cbc blowfish-cbc cast128-cbc aes128-cbc aes192-cbc aes256-cbc arcfour arcfour128 arcfour256 rijndael-cbc@lysator.liu.se)
   l_offered="$(sshd -T | awk '"'"'$1=="ciphers"{print $2}'"'"' | tr '"'"','"'"' '"'"'\n'"'"')"
   for l_alg in "${a_weak[@]}"; do
      grep -Fxq -- "$l_alg" <<< "$l_offered" && printf '"'"'%s\n'"'"' "$l_alg"
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; o=$(bash -c 'sshd -T 2>&1 | awk '"'"'($1=="ciphers" && $2~/chacha20- poly1305@openssh\.com/){print}'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'On OpenSSH 9.6 and later the Terrapin attack (CVE-2023-48795) is mitigated by' || { echo step2: missing 'On OpenSSH 9.6 and later the Terrapin attack (CVE-2023-48795'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'default through strict key exchange, so a returned line does not by itself indicate a' || { echo step2: missing 'default through strict key exchange, so a returned line does'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'weakness. On earlier OpenSSH releases, if a line is returned, review CVE-2023-48795' || { echo step2: missing 'weakness. On earlier OpenSSH releases, if a line is returned'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'and verify the system has been patched, and consider excluding chacha20-poly1305' || { echo step2: missing 'and verify the system has been patched, and consider excludi'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'through the system-wide crypto policy.' || { echo step2: missing 'through the system-wide crypto policy.'; return 1; }; }; if alt0; then echo compliant; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

The ciphers available to the SSH server are governed by the system-wide crypto policy. Disable the weak ciphers by configuring the system-wide crypto policy as described in the "Configure system wide crypto policy" section. - IF - CVE-2023-48795 (Terrapin) has not been reviewed and addressed, chacha20- poly1305 should also be disabled through the system-wide crypto policy. Once the crypto policy has been updated, reload the SSH daemon: # systemctl reload-or-restart sshd

Propriedades

Sistemas operacionais: rocky-9
Tags: cis-convertedlinux
Referência: CIS Rocky Linux 9 Benchmark v3.0.0 - 5.1.5

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target linux