Ensure sshd MACs are configured

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; line=$(printf '%s\n' "$out" | grep -i '^macs '); [ -n "$line" ] || exit 1; printf '%s\n' "$line" | grep -Eiq -- '(^|[ ,])(hmac-md5|hmac-md5-96|hmac-ripemd160|hmac-sha1-96|umac-64@openssh\.com|hmac-md5-etm@openssh\.com|hmac-md5-96-etm@openssh\.com|hmac-ripemd160-etm@openssh\.com|hmac-sha1-96-etm@openssh\.com|umac-64-etm@openssh\.com|umac-128-etm@openssh\.com)(,|$)' && echo "weak: $line" || echo compliant

Beklenen çıktı

compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Edit the /etc/ssh/sshd_config file and add/modify the MACs line to contain a comma separated list of the site unapproved (weak) MACs preceded with a -: Example: MACs -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac- 64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac- ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64- etm@openssh.com,umac-128-etm@openssh.com - IF - CVE-2023-48795 has not been reviewed and addressed, the following etm MACs should be added to the exclude list: hmac-sha1-etm@openssh.com,hmac-sha2-256- etm@openssh.com,hmac-sha2-512-etm@openssh.com Re-cycle the sshd daemon to pick up the configuration changes: stopsrc -s sshd startsrc -s sshd

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

tmaegis scan --target aix