From 75556bf3147f02af03ce9c962d3a8855ea374a17 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Sachse?= <joerg.sachse@slub-dresden.de>
Date: Fri, 22 Dec 2023 13:16:37 +0100
Subject: [PATCH] sec: implement Terrapin (CVE-2023-48795) config mitigations
while patches are unavailable
---
tasks/configure_ssh_hardening.yml | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/tasks/configure_ssh_hardening.yml b/tasks/configure_ssh_hardening.yml
index ef041e7..ecb6933 100644
--- a/tasks/configure_ssh_hardening.yml
+++ b/tasks/configure_ssh_hardening.yml
@@ -56,6 +56,9 @@
KexAlgorithms diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org
# disable weak Ciphers (crypto algorithms)
# NVT OID: 1.3.6.1.4.1.25623.1.0.105611
- Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
+ # Also explicitely disable ChaCha ciphers for "Terrapin" (CVE-2023-48795)
+ Ciphers aes256-ctr,aes192-ctr,aes128-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com,-chacha20-poly1305@openssh.com
+ # Explicitely disable -ETM MACs for "Terrapin" (CVE-2023-48795)
+ MACs hmac-sha2-512,hmac-sha2-256,-*etm@openssh.com
notify:
- restart sshd
--
GitLab