Ensure sshd KexAlgorithms is configured

中级别 1自动化linux

说明

Key exchange is any method in cryptography by which cryptographic keys are exchanged between two parties, allowing use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received Notes: • Kex algorithms have a higher preference the earlier they appear in the list • Some organizations may have stricter requirements for approved Key exchange algorithms • Ensure that Key exchange algorithms used are in compliance with site policy • The only Key Exchange Algorithms currently FIPS 14

检查方式

审计方法: Shell 命令

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash
{
   a_weak=(diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie- hellman-group-exchange-sha1)
   l_offered="$(sshd -T | awk '"'"'$1=="kexalgorithms"{print $2}'"'"' | tr '"'"','"'"' '"'"'\n'"'"')"
   for l_alg in "${a_weak[@]}"; do
      grep -Fxq -- "$l_alg" <<< "$l_offered" && printf '"'"'%s\n'"'"' "$l_alg"
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

The key exchange algorithms available to the SSH server are governed by the system- wide crypto policy. The weak key exchange algorithms in scope are SHA1-based; disable them by disabling SHA1 hash and signature support in the system-wide crypto policy as described in the "Configure system wide crypto policy" section. Once the crypto policy has been updated, reload the SSH daemon: # systemctl reload-or-restart sshd

属性

操作系统: rocky-9
标签: cis-convertedlinux
参考: CIS Rocky Linux 9 Benchmark v3.0.0 - 5.1.6

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target linux