TMA-FREEBSD-4.2.11
Ensure sshd KexAlgorithms is configured
Opis
Key exchange is any cryptography method that exchanges cryptographic keys between two parties, allowing the use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received. Key exchange methods that are considered weak should be removed. A key exchange method may be weak because too few bits are used or the hashing algorithm is considered too weak. Using weak algorithms could expose connections to man-in-the- middle attacks. Audit: the effective `kexalgorithms` list from `sshd -T` must not contain any weak algorithm listed by CIS.
Kako se proverava
Metod provere: Komanda ljuske
command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; line=$(printf '%s\n' "$out" | grep -i '^kexalgorithms '); [ -n "$line" ] || exit 1; printf '%s\n' "$line" | grep -Eiq -- '(^|[ ,])(diffie-hellman-group1-sha1|diffie-hellman-group14-sha1|diffie-hellman-group-exchange-sha1)(,|$)' && echo "weak: $line" || echo compliant- Očekivani izlaz
compliant
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
Edit the /etc/ssh/sshd_config file and add/modify the KexAlgorithms line to contain a comma-separated list of the site unapproved (weak) KexAlgorithms preceded with a - above any Include entries: Example: KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie- hellman-group-exchange-sha1
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- freebsdssh
- Referenca
- CIS FreeBSD 14 Benchmark v1.0.1 - 4.2.11 Ensure sshd KexAlgorithms is configured
Proverite ovaj računar
Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.
tmaegis scan --target freebsd