Ensure sshd KexAlgorithms is configured

SrednjaNivo 1Automatskalinux

Opis

Key exchange is any method in cryptography by which cryptographic keys are exchanged between two parties, allowing use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received Notes: • Kex algorithms have a higher preference the earlier they appear in the list • Some organizations may have stricter requirements for approved Key exchange algorithms • Ensure that Key exchange algorithms used are in compliance with site policy • The only Key Exchange Algorithms currently FIPS 14

Kako se proverava

Metod provere: Komanda ljuske

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash
{
   a_weak=(diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie- hellman-group-exchange-sha1)
   l_offered="$(sshd -T | awk '"'"'$1=="kexalgorithms"{print $2}'"'"' | tr '"'"','"'"' '"'"'\n'"'"')"
   for l_alg in "${a_weak[@]}"; do
      grep -Fxq -- "$l_alg" <<< "$l_offered" && printf '"'"'%s\n'"'"' "$l_alg"
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

The key exchange algorithms available to the SSH server are governed by the system- wide crypto policy. The weak key exchange algorithms in scope are SHA1-based; disable them by disabling SHA1 hash and signature support in the system-wide crypto policy as described in the "Configure system wide crypto policy" section. Once the crypto policy has been updated, reload the SSH daemon: # systemctl reload-or-restart sshd

Svojstva

Operativni sistemi: almalinux-9
Oznake: cis-convertedlinux
Referenca: CIS AlmaLinux OS 9 Benchmark v3.0.0 - 5.1.6

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target linux