TMA-ROCKY8-1.6.4

Ensure system wide crypto policy disables cbc for ssh

中等級 1自動化linux

說明

Cypher Block Chaining (CBC) is an algorithm that uses a block cipher.

檢查方式

稽核方法: Shell 指令

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_output="" l_output2=""
   if grep -Piq -- '"'"'^\h*cipher\h*=\h*([^#\n\r]+)?-CBC\b'"'"' /etc/crypto- policies/state/CURRENT.pol; then
      if grep -Piq -- '"'"'^\h*cipher@(lib|open)ssh(-server|-client)?\h*=\h*'"'"' /etc/crypto-policies/state/CURRENT.pol; then
         if ! grep -Piq -- '"'"'^\h*cipher@(lib|open)ssh(-server|- client)?\h*=\h*([^#\n\r]+)?-CBC\b'"'"' /etc/crypto-policies/state/CURRENT.pol; then
            l_output="$l_output\n - Cipher Block Chaining (CBC) is disabled for SSH"
         else
            l_output2="$l_output2\n - Cipher Block Chaining (CBC) is enabled for SSH"
         fi
      else
         l_output2="$l_output2\n - Cipher Block Chaining (CBC) is enabled for SSH"
      fi
   else
      l_output=" - Cipher Block Chaining (CBC) is disabled"
   fi
   if [ -z "$l_output2" ]; then # Provide output from checks
      echo -e "\n- Audit Result:\n  ** PASS **\n$l_output\n"
   else
      echo -e "\n- Audit Result:\n  ** FAIL **\n - Reason(s) for audit failure:\n$l_output2\n"
      [ -n "$l_output" ] && echo -e "\n- Correctly set:\n$l_output\n"
   fi
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Note: • The commands below are written for the included DEFAULT system-wide crypto policy. If another policy is in use and follows local site policy, replace DEFAULT with the name of your system-wide crypto policy. • CBC can be turned off globally by using the argument cipher opposed to cipher@SSH • Multiple subpolicies may be assigned to a policy as a colon separated list. e.g. DEFAULT:NO-SHA1:NO-SSHCBC • Subpolicies: o Not included in the update-crypto-policies --set command will not be applied to the system wide crypto policy. o must exist before they can be applied to the system wide crypto policy. o .pmod file filenames must be in all upper case, upper case, e.g. NO- SSHCBC.pmod, or the…

屬性

作業系統: rocky-8
標籤: cis-convertedlinux
參考資料: CIS Rocky Linux 8 Benchmark v3.0.0 - 1.6.4

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target linux