diff --git a/tasks/configure_ssh_hardening.yml b/tasks/configure_ssh_hardening.yml index ef041e7ccfc6d310394d04beacd0e6d87997877d..ecb69332f4c6f2d9572f650077c3ed33dd84c234 100644 --- a/tasks/configure_ssh_hardening.yml +++ b/tasks/configure_ssh_hardening.yml @@ -56,6 +56,9 @@ KexAlgorithms diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org # disable weak Ciphers (crypto algorithms) # NVT OID: 1.3.6.1.4.1.25623.1.0.105611 - Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com + # Also explicitely disable ChaCha ciphers for "Terrapin" (CVE-2023-48795) + Ciphers aes256-ctr,aes192-ctr,aes128-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com,-chacha20-poly1305@openssh.com + # Explicitely disable -ETM MACs for "Terrapin" (CVE-2023-48795) + MACs hmac-sha2-512,hmac-sha2-256,-*etm@openssh.com notify: - restart sshd