Ensure sshd Ciphers are configured

中等級 1自動化linux

說明

Secure Shell (SSH) ciphers are encryption algorithms used by the SSH protocol to secure data transmitted between a client and a server. They protect the privacy and integrity of the connection, using symmetric encryption to encrypt data after a secure session is established. During connection setup, the client and server negotiate to select the strongest available cipher that both support, ensuring the connection is as secure as possible More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

檢查方式

稽核方法: Shell 指令

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash
{
   a_weak=(3des-cbc blowfish-cbc cast128-cbc aes128-cbc aes192-cbc aes256-cbc arcfour arcfour128 arcfour256 rijndael-cbc@lysator.liu.se)
   l_offered="$(sshd -T | awk '"'"'$1=="ciphers"{print $2}'"'"' | tr '"'"','"'"' '"'"'\n'"'"')"
   for l_alg in "${a_weak[@]}"; do
      grep -Fxq -- "$l_alg" <<< "$l_offered" && printf '"'"'%s\n'"'"' "$l_alg"
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; o=$(bash -c 'sshd -T 2>&1 | awk '"'"'($1=="ciphers" && $2~/chacha20- poly1305@openssh\.com/){print}'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'On OpenSSH 9.6 and later the Terrapin attack (CVE-2023-48795) is mitigated by' || { echo step2: missing 'On OpenSSH 9.6 and later the Terrapin attack (CVE-2023-48795'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'default through strict key exchange, so a returned line does not by itself indicate a' || { echo step2: missing 'default through strict key exchange, so a returned line does'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'weakness. On earlier OpenSSH releases, if a line is returned, review CVE-2023-48795' || { echo step2: missing 'weakness. On earlier OpenSSH releases, if a line is returned'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'and verify the system has been patched, and consider excluding chacha20-poly1305' || { echo step2: missing 'and verify the system has been patched, and consider excludi'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'through the system-wide crypto policy.' || { echo step2: missing 'through the system-wide crypto policy.'; return 1; }; }; if alt0; then echo compliant; fi

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

The ciphers available to the SSH server are governed by the system-wide crypto policy. Disable the weak ciphers by configuring the system-wide crypto policy as described in the "Configure system wide crypto policy" section. - IF - CVE-2023-48795 (Terrapin) has not been reviewed and addressed, chacha20- poly1305 should also be disabled through the system-wide crypto policy. Once the crypto policy has been updated, reload the SSH daemon: # systemctl reload-or-restart sshd

屬性

作業系統: rocky-9
標籤: cis-convertedlinux
參考資料: CIS Rocky Linux 9 Benchmark v3.0.0 - 5.1.5

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target linux