Ensure system wide crypto policy disables cbc for ssh

OrtaDüzey 1Otomatiklinux

Açıklama

Cypher Block Chaining (CBC) is an algorithm that uses a block cipher.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_output="" l_output2=""
   if grep -Piq -- '"'"'^\h*cipher\h*=\h*([^#\n\r]+)?-CBC\b'"'"' /etc/crypto- policies/state/CURRENT.pol; then
      if grep -Piq -- '"'"'^\h*cipher@(lib|open)ssh(-server|-client)?\h*=\h*'"'"' /etc/crypto-policies/state/CURRENT.pol; then
         if ! grep -Piq -- '"'"'^\h*cipher@(lib|open)ssh(-server|- client)?\h*=\h*([^#\n\r]+)?-CBC\b'"'"' /etc/crypto-policies/state/CURRENT.pol; then
            l_output="$l_output\n - Cipher Block Chaining (CBC) is disabled for SSH"
         else
            l_output2="$l_output2\n - Cipher Block Chaining (CBC) is enabled for SSH"
         fi
      else
         l_output2="$l_output2\n - Cipher Block Chaining (CBC) is enabled for SSH"
      fi
   else
      l_output=" - Cipher Block Chaining (CBC) is disabled"
   fi
   if [ -z "$l_output2" ]; then # Provide output from checks
      echo -e "\n- Audit Result:\n  ** PASS **\n$l_output\n"
   else
      echo -e "\n- Audit Result:\n  ** FAIL **\n - Reason(s) for audit failure:\n$l_output2\n"
      [ -n "$l_output" ] && echo -e "\n- Correctly set:\n$l_output\n"
   fi
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Note: • The commands below are written for the included DEFAULT system-wide crypto policy. If another policy is in use and follows local site policy, replace DEFAULT with the name of your system-wide crypto policy. • CBC can be turned off globally by using the argument cipher opposed to cipher@SSH • Multiple subpolicies may be assigned to a policy as a colon separated list. e.g. DEFAULT:NO-SHA1:NO-SSHCBC • Subpolicies: o Not included in the update-crypto-policies --set command will not be applied to the system wide crypto policy. o must exist before they can be applied to the system wide crypto policy. o .pmod file filenames must be in all upper case, upper case, e.g. NO- SSHCBC.pmod, or the…

Özellikler

İşletim sistemleri: almalinux-8
Etiketler: cis-convertedlinux
Referans: CIS AlmaLinux OS 8 Benchmark v4.0.0 - 1.6.4

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target linux