cis-ubuntu2004-v300-5-1-12

name	cis-ubuntu2004-v300-5-1-12
description	Ensure sshd KexAlgorithms is configured
category	cis-networking
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","ssh"]
cis_id	5.1.12
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure sshd KexAlgorithms is configured (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

Key exchange is any method in cryptography by which cryptographic keys are exchanged between two parties, allowing use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received.

Notes:

• Kex algorithms have a higher preference the earlier they appear in the list
• Some organizations may have stricter requirements for approved Key exchange algorithms
• Ensure that Key exchange algorithms used are in compliance with site policy
• The only Key Exchange Algorithms currently FIPS 140 approved are:
  • ecdh-sha2-nistp256
  • ecdh-sha2-nistp384
  • ecdh-sha2-nistp521
  • diffie-hellman-group-exchange-sha256
  • diffie-hellman-group16-sha512
  • diffie-hellman-group18-sha512
  • diffie-hellman-group14-sha256

Rationale

Key exchange methods that are considered weak should be removed. A key exchange method may be weak because too few bits are used, or the hashing algorithm is considered too weak. Using weak algorithms could expose connections to man-in-the-middle attacks.

Audit Procedure

Command Line

Run the following command to verify none of the "weak" Key Exchange algorithms are being used:

# sshd -T | grep -Pi -- 'kexalgorithms\h+([^#\n\r]+,)?(diffie-hellman-group1-sha1|diffie-hellman-group14-sha1|diffie-hellman-group-exchange-sha1)\b'

Nothing should be returned.

• IF - A line is returned, review the list of Key Exchange Algorithms. The following are considered "weak" Key Exchange Algorithms, and should not be used:

diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group-exchange-sha1

Expected Result

Nothing should be returned (no weak KexAlgorithms in use).

Remediation

Command Line

Edit the /etc/ssh/sshd_config file and add/modify the KexAlgorithms line to contain a comma separated list of the site unapproved (weak) KexAlgorithms preceded with a - above any Include entries: Example:

KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1