Ensure sshd KexAlgorithms is configured

ВисокаНиво 1Аутоматскаfreebsd

Опис

Key exchange is any cryptography method that exchanges cryptographic keys between two parties, allowing the use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received. Key exchange methods that are considered weak should be removed. A key exchange method may be weak because too few bits are used or the hashing algorithm is considered too weak. Using weak algorithms could expose connections to man-in-the- middle attacks. Audit: the effective `kexalgorithms` list from `sshd -T` must not contain any weak algorithm listed by CIS.

Како се проверава

Метод провере: Команда љуске

shell

command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; line=$(printf '%s\n' "$out" | grep -i '^kexalgorithms '); [ -n "$line" ] || exit 1; printf '%s\n' "$line" | grep -Eiq -- '(^|[ ,])(diffie-hellman-group1-sha1|diffie-hellman-group14-sha1|diffie-hellman-group-exchange-sha1)(,|$)' && echo "weak: $line" || echo compliant

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Edit the /etc/ssh/sshd_config file and add/modify the KexAlgorithms line to contain a comma-separated list of the site unapproved (weak) KexAlgorithms preceded with a - above any Include entries: Example: KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie- hellman-group-exchange-sha1

Својства

Оперативни системи: Било који
Ознаке: freebsdssh
Референца: CIS FreeBSD 14 Benchmark v1.0.1 - 4.2.11 Ensure sshd KexAlgorithms is configured

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target freebsd