centos7 OpenSSL ‘Diffie-Hellman key-exchange’安全漏洞

centos7 OpenSSL ‘Diffie-Hellman key-exchange’安全漏洞

centos7 OpenSSL ‘Diffie-Hellman key-exchange’安全漏洞_第1张图片centos7 OpenSSL ‘Diffie-Hellman key-exchange’安全漏洞_第2张图片centos7 OpenSSL ‘Diffie-Hellman key-exchange’安全漏洞_第3张图片centos7 OpenSSL ‘Diffie-Hellman key-exchange’安全漏洞_第4张图片

KexAlgorithms
Specifies the available KEX (Key Exchange) algorithms. #指定可用的KEX(密钥交换)算法。
Multiple algorithms must be comma-separated. #多个算法必须用逗号分隔。
The default is #以下为默认算法
ecdh-sha2-nistp256 ,
ecdh-sha2-nistp384 ,
ecdh-sha2-nistp521 ,
diffie-hellman-group-exchange-sha256 ,
diffie-hellman-group-exchange-sha1 ,
diffie-hellman-group14-sha1 ,
diffie-hellman-group1-sha1 .

缺陷

diffic-hellman-group1-sha1 和diffie-hellman-group-exchange-sha1的长度只有1024位,被认为是弱密钥交换算法

解决方法

vim /etc/ssh/sshd_config
在文本结尾新增配置如下:
kexalgorithms curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1

保存退出重启sshd服务
:wq
systemclt restart sshd

你可能感兴趣的:(linux-系统加固)