1、在Anolis OS8系统，写入sshd_config文件指定加密算法并未生效。
备份sshd配置文件
cp /etc/ssh/sshd_config /etc/ssh/sshd_config20221012
修改sshd配置文件
vim /etc/ssh/sshd_config
在最后添加以下内容
Ciphers aes128-ctr,aes192-ctr,aes256-ctr
保存退出，重启sshd服务
systemctl restart sshd
从另外的linux服务器上验证结果
# nmap --script "ssh2*" 47.92.80.2xx
Starting Nmap 6.40 ( http://nmap.org ) at 2022-10-12 15:24 CST
Nmap scan report for 47.92.80.2xx
Host is up (0.013s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
22/tcp open ssh
| ssh2-enum-algos:
| kex_algorithms (11)
| curve25519-sha256
| [email protected]
| ecdh-sha2-nistp256
| ecdh-sha2-nistp384
| ecdh-sha2-nistp521
| diffie-hellman-group-exchange-sha256
| diffie-hellman-group14-sha256
| diffie-hellman-group16-sha512
| diffie-hellman-group18-sha512
| diffie-hellman-group-exchange-sha1
| diffie-hellman-group14-sha1
| server_host_key_algorithms (5)
| rsa-sha2-512
| rsa-sha2-256
| ssh-rsa
| ecdsa-sha2-nistp256
| ssh-ed25519
| encryption_algorithms (7)
| [email protected]
| [email protected]
| aes256-ctr
| aes256-cbc
| [email protected]
| aes128-ctr
| aes128-cbc
| mac_algorithms (8)
| [email protected]
| [email protected]
| [email protected]
| [email protected]
| hmac-sha2-256
| hmac-sha1
| [email protected]
| hmac-sha2-512
| compression_algorithms (2)
| none
|_ [email protected]
3389/tcp closed ms-wbt-server
Nmap done: 1 IP address (1 host up) scanned in 4.77 seconds
发现还是存在CBC类型加密算法(aes256-cbc、aes128-cbc)，随即对anolis8版本弱加密算法更改进行排查
2、排查anolis8需更改文件
image.png
man sshd_config发现并未标明系统默认支持加密算法，以及开头这句话：
The default is handled system-wide by crypto-policies(7). To see the current defaults and how to modify them, see manual page update-crypto-policies(8).
意思就是默认的加密策略由crypto-policies(7)处理。需要查看当前默认值以及更改需要查看手册update-crypto-policies(8).
继续 man
3、定位需更改文件位置
image.png
直接找到FILES，找到这个位置：
/etc/crypto-policies/back-ends
Contains the generated policies in separated files, and in a format readable by the supported back ends.
这个目录下的是单独的策略文件，看下面，是个软链接实际文件在后面
[root@anolis ~]# cd /etc/crypto-policies/back-ends
[root@anolis back-ends]# ll
total 4
......
lrwxrwxrwx 1 root root 52 Jul 4 13:18 opensshserver.config -> /usr/share/crypto-policies/DEFAULT/opensshserver.txt
......
#先备份配置文件
[root@anolis back-ends]# cp /usr/share/crypto-policies/DEFAULT/opensshserver.txt /root/
4、定位文件后更改
编辑opensshserver.config文件，删除首行中带 “.cbc”的内容
#原配置文件：
[root@anolis back-ends]# cat /root/opensshserver.txt
CRYPTO_POLICY='[email protected],[email protected],aes256-ctr,aes256-cbc,[email protected],aes128-ctr,aes128-cbc [email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,[email protected],hmac-sha2-512 -oGSSAPIKexAlgorithms=gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-,gss-gex-sha1-,gss-group14-sha1- -oKexAlgorithms=curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ecdsa-sha2-nistp256,[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected],ssh-rsa,[email protected] -oPubkeyAcceptedKeyTypes=ecdsa-sha2-nistp256,[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected],ssh-rsa,[email protected] -oCASignatureAlgorithms=ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-256,rsa-sha2-512,ssh-rsa'
#修改配置文件
[root@anolis back-ends]# vim /usr/share/crypto-policies/DEFAULT/opensshserver.txt
#删除第一行中的"aes128-cbc"和"aes256-cbc"，修改后的配置文件如下：
[root@anolis back-ends]# cat /usr/share/crypto-policies/DEFAULT/opensshserver.txt
CRYPTO_POLICY='[email protected],[email protected],aes256-ctr,[email protected],aes128-ctr [email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,[email protected],hmac-sha2-512 -oGSSAPIKexAlgorithms=gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-,gss-gex-sha1-,gss-group14-sha1- -oKexAlgorithms=curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ecdsa-sha2-nistp256,[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected],ssh-rsa,[email protected] -oPubkeyAcceptedKeyTypes=ecdsa-sha2-nistp256,[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected],ssh-rsa,[email protected] -oCASignatureAlgorithms=ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-256,rsa-sha2-512,ssh-rsa'
#重启服务
[root@anolis back-ends]# systemctl restart sshd
[root@anolis back-ends]# systemctl restart sshd
5、现在验证
[root@test-web2 ~]# nmap --script "ssh2*" 47.92.80.2xx
Starting Nmap 6.40 ( http://nmap.org ) at 2022-10-12 15:35 CST
Nmap scan report for 47.92.80.2xx
Host is up (0.014s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
22/tcp open ssh
| ssh2-enum-algos:
| kex_algorithms (11)
| curve25519-sha256
| [email protected]
| ecdh-sha2-nistp256
| ecdh-sha2-nistp384
| ecdh-sha2-nistp521
| diffie-hellman-group-exchange-sha256
| diffie-hellman-group14-sha256
| diffie-hellman-group16-sha512
| diffie-hellman-group18-sha512
| diffie-hellman-group-exchange-sha1
| diffie-hellman-group14-sha1
| server_host_key_algorithms (5)
| rsa-sha2-512
| rsa-sha2-256
| ssh-rsa
| ecdsa-sha2-nistp256
| ssh-ed25519
| encryption_algorithms (5)
| [email protected]
| [email protected]
| aes256-ctr
| [email protected]
| aes128-ctr
| mac_algorithms (8)
| [email protected]
| [email protected]
| [email protected]
| [email protected]
| hmac-sha2-256
| hmac-sha1
| [email protected]
| hmac-sha2-512
| compression_algorithms (2)
| none
|_ [email protected]
3389/tcp closed ms-wbt-server
Nmap done: 1 IP address (1 host up) scanned in 5.81 seconds
可以看到，cbc相关弱加密算法已经没有了，anolis8 系统下OpenSSH CBC模式 弱加密算法漏洞解决。