search

jtesta / ssh-audit

SSH server & client security auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc)
MIT License
3.23k stars 165 forks source link

[Potential] Improvement for restricting supported key exchange, cipher, and MAC algorithms | ssh-audit/wiki/macOS-13-(Ventura)-&-14-(Sonoma) #246

Closed A-Metal-Penguin closed 4 months ago

A-Metal-Penguin commented 5 months ago

NOTE: I'm REALLY new to these kinds of things, so maybe I'm just inexperienced and did something wrong initially.

I clicked the copy button on Step 4 to restrict the supported key exchange, cipher and MAC algorithms only for the command to fail due to multiple lines. To fix this, I used \n and it worked just fine.

echo '\n# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com\n# hardening guide.\nKexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256\nCiphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com\nHostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256' > /etc/ssh/sshd_config.d/99_hardening.conf

[Probably Unnecessary Note]: I had to mkdir /etc/ssh/sshd_config.d as the directory "sshd_config.d" didn't exist. Maybe it should have already and for some odd reason it didn't on my Mac? I'm trying to improve an already configured computer, so perhaps it was set up oddly.
jtesta commented 4 months ago

Thanks for reporting this.

I don't have a MacOS machine to test this on, so I'm not comfortable with making the update myself. I suppose we could just leave it as-is for now, and perhaps someone from the community will update the wiki page as needed, if its a reproducible problem.