Ensure sshd KexAlgorithms is configured

СредњаНиво 1Аутоматскаlinux

Опис

Key exchange is any method in cryptography by which cryptographic keys are exchanged between two parties, allowing use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received Notes: • Kex algorithms have a higher preference the earlier they appear in the list • Some organizations may have stricter requirements for approved Key exchange algorithms • Ensure that Key exchange algorithms used are in compliance with site policy • The only Key Exchange Algorithms currently FIPS 14

Како се проверава

Метод провере: Команда љуске

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash
{
   a_weak=(diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie- hellman-group-exchange-sha1)
   l_offered="$(sshd -T | awk '"'"'$1=="kexalgorithms"{print $2}'"'"' | tr '"'"','"'"' '"'"'\n'"'"')"
   for l_alg in "${a_weak[@]}"; do
      grep -Fxq -- "$l_alg" <<< "$l_offered" && printf '"'"'%s\n'"'"' "$l_alg"
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

The key exchange algorithms available to the SSH server are governed by the system- wide crypto policy. The weak key exchange algorithms in scope are SHA1-based; disable them by disabling SHA1 hash and signature support in the system-wide crypto policy as described in the "Configure system wide crypto policy" section. Once the crypto policy has been updated, reload the SSH daemon: # systemctl reload-or-restart sshd

Својства

Оперативни системи: rocky-9
Ознаке: cis-convertedlinux
Референца: CIS Rocky Linux 9 Benchmark v3.0.0 - 5.1.6

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target linux