CVE-2002-20001处理方法

1、查询当前openssh支撑的算法

man sshd_config |grep -A 40 -w KexAlgorithms

#用来查询当前openssh支撑的算法
以下是我查询centos7.6的结果
[email protected],diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521

2、将openssh所有支持的算法全都添加至KexAlgorithms后面,然后去除diffie相关算法

centos7.6

echo "KexAlgorithms curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521" >> /etc/ssh/sshd_config

centos7.8

echo "KexAlgorithms curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,[email protected]" >> /etc/ssh/sshd_config

3、重启ssh服务

systemctl restart sshd

4、检查 sshd 服务的实际配置，并查找 kexalgorithms 字段，以确保服务器端已成功设置为使用指定的密钥交换算法

sshd -T | grep -w kexalgorithms

5、查看ssh服务是否正常

systemctl status sshd.service