Ensure sshd Ciphers are configured

Trung bìnhCấp 1Tự độnglinux

Mô tả

Secure Shell (SSH) ciphers are encryption algorithms used by the SSH protocol to secure data transmitted between a client and a server. They protect the privacy and integrity of the connection, using symmetric encryption to encrypt data after a secure session is established. During connection setup, the client and server negotiate to select the strongest available cipher that both support, ensuring the connection is as secure as possible More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash
{
   a_weak=(3des-cbc blowfish-cbc cast128-cbc aes128-cbc aes192-cbc aes256-cbc arcfour arcfour128 arcfour256 rijndael-cbc@lysator.liu.se)
   l_offered="$(sshd -T | awk '"'"'$1=="ciphers"{print $2}'"'"' | tr '"'"','"'"' '"'"'\n'"'"')"
   for l_alg in "${a_weak[@]}"; do
      grep -Fxq -- "$l_alg" <<< "$l_offered" && printf '"'"'%s\n'"'"' "$l_alg"
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; o=$(bash -c 'sshd -T 2>&1 | awk '"'"'($1=="ciphers" && $2~/chacha20- poly1305@openssh\.com/){print}'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'On OpenSSH 9.6 and later the Terrapin attack (CVE-2023-48795) is mitigated by' || { echo step2: missing 'On OpenSSH 9.6 and later the Terrapin attack (CVE-2023-48795'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'default through strict key exchange, so a returned line does not by itself indicate a' || { echo step2: missing 'default through strict key exchange, so a returned line does'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'weakness. On earlier OpenSSH releases, if a line is returned, review CVE-2023-48795' || { echo step2: missing 'weakness. On earlier OpenSSH releases, if a line is returned'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'and verify the system has been patched, and consider excluding chacha20-poly1305' || { echo step2: missing 'and verify the system has been patched, and consider excludi'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'through the system-wide crypto policy.' || { echo step2: missing 'through the system-wide crypto policy.'; return 1; }; }; if alt0; then echo compliant; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

The ciphers available to the SSH server are governed by the system-wide crypto policy. Disable the weak ciphers by configuring the system-wide crypto policy as described in the "Configure system wide crypto policy" section. - IF - CVE-2023-48795 (Terrapin) has not been reviewed and addressed, chacha20- poly1305 should also be disabled through the system-wide crypto policy. Once the crypto policy has been updated, reload the SSH daemon: # systemctl reload-or-restart sshd

Thuộc tính

Hệ điều hành: rhel-9
Thẻ: cis-convertedlinux
Tham chiếu: CIS Red Hat Enterprise Linux 9 Benchmark v3.0.0 - 5.1.5

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target linux