CentOS 7 에서 OpenSSH 취약점 (취약한 알고리즘) 조치 방법

[ 취약한 알고리즘 ]
Running SSH serviceInsecure CBC ciphers in use: aes128-cbc,aes192-cbc,blowfish-cbc,cast128-cbc,aes256-cbc
Running SSH serviceInsecure 3DES ciphers in use: 3des-cbc
Running SSH serviceInsecure key exchange in use: diffie-hellman-group1-sha1
Running SSH serviceInsecure key exchange algorithms in use: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
Running SSH serviceInsecure MAC algorithms in use: umac-64-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,hmac-sha1

 

[ 현재 허용된 알고리즘 확인 ]
아래와 같은 명령어로 확인이 가능합니다.

 

(명령)

# sshd -T | grep "\(^ciphers\|^macs\|^kexalgorithms\)"

(결과)
ciphers chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
macs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1

kexalgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1


[ 설정 변경 및 적용 ]
설정 파일을 열어 아래 내용 삽입 (또는 수정) 후 sshd 데몬을 재시작 합니다.
기본 옵션으로 모두 허용되어 있으므로 위 출력 결과에서 사용하지 않을 알고리즘만 제거하고 입력하였습니다.

 

# vi /etc/ssh/sshd_config

ciphers chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
macs umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512
kexalgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1

# service sshd restart

 

 

[ 변경된 알고리즘 재확인 ]

 

(명령)

# sshd -T | grep "\(^ciphers\|^macs\|^kexalgorithms\)"

 

(결과)
ciphers chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
macs umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512
kexalgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1