Ensure sshd Ciphers are configured

СредњаНиво 1Аутоматскаlinux

Опис

Secure Shell (SSH) ciphers are encryption algorithms used by the SSH protocol to secure data transmitted between a client and a server. They protect the privacy and integrity of the connection, using symmetric encryption to encrypt data after a secure session is established. During connection setup, the client and server negotiate to select the strongest available cipher that both support, ensuring the connection is as secure as possible More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

Како се проверава

Метод провере: Команда љуске

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash
{
   a_weak=(3des-cbc blowfish-cbc cast128-cbc aes128-cbc aes192-cbc aes256-cbc arcfour arcfour128 arcfour256 rijndael-cbc@lysator.liu.se)
   l_offered="$(sshd -T | awk '"'"'$1=="ciphers"{print $2}'"'"' | tr '"'"','"'"' '"'"'\n'"'"')"
   for l_alg in "${a_weak[@]}"; do
      grep -Fxq -- "$l_alg" <<< "$l_offered" && printf '"'"'%s\n'"'"' "$l_alg"
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; o=$(bash -c 'sshd -T 2>&1 | awk '"'"'($1=="ciphers" && $2~/chacha20- poly1305@openssh\.com/){print}'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'On OpenSSH 9.6 and later the Terrapin attack (CVE-2023-48795) is mitigated by' || { echo step2: missing 'On OpenSSH 9.6 and later the Terrapin attack (CVE-2023-48795'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'default through strict key exchange, so a returned line does not by itself indicate a' || { echo step2: missing 'default through strict key exchange, so a returned line does'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'weakness. On earlier OpenSSH releases, if a line is returned, review CVE-2023-48795' || { echo step2: missing 'weakness. On earlier OpenSSH releases, if a line is returned'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'and verify the system has been patched, and consider excluding chacha20-poly1305' || { echo step2: missing 'and verify the system has been patched, and consider excludi'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'through the system-wide crypto policy.' || { echo step2: missing 'through the system-wide crypto policy.'; return 1; }; }; if alt0; then echo compliant; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

The ciphers available to the SSH server are governed by the system-wide crypto policy. Disable the weak ciphers by configuring the system-wide crypto policy as described in the "Configure system wide crypto policy" section. - IF - CVE-2023-48795 (Terrapin) has not been reviewed and addressed, chacha20- poly1305 should also be disabled through the system-wide crypto policy. Once the crypto policy has been updated, reload the SSH daemon: # systemctl reload-or-restart sshd

Својства

Оперативни системи: rocky-9
Ознаке: cis-convertedlinux
Референца: CIS Rocky Linux 9 Benchmark v3.0.0 - 5.1.5

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target linux