1

I am trying to fix my SSH setup on Fedora and RedHat with ssh-audit.

I managed to fix the ciphers and algorithms by setting

KexAlgorithms diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com

in /etc/ssh/sshd_config

The audit tool is still complaining about the host keys that should be re-generated:

# host-key algorithms
[...]
(key) ecdsa-sha2-nistp256            -- [fail] using weak elliptic curves
                                     `- [warn] using weak random number generator could reveal the key
                                     `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
[...]
# algorithm recommendations (for OpenSSH 7.9)
(rec) -ecdsa-sha2-nistp256           -- key algorithm to remove 

I then recreated the Diffie-Hellman moduli and generated new keys

rm -fv /etc/ssh/ssh_host_*
ssh-keygen -G moduli-2048.candidates -b 2048
ssh-keygen -T moduli-2048 -f moduli-2048.candidates
cp moduli-2048 /etc/ssh/moduli
ssh-keygen -A

The audit tool is still complaining. How could I use a better random number generator? I can I exclude ecdsa-sha2-nistp256 by the key generation?

1

All of the curves used by ECDSA keys are considered weak. Just delete the ssh_host_ecdsa_key and ssh_host_ecdsa_key.pub files without replacing them, and/or comment out the entries for them in sshd_config. The only kinds of keys worth having are RSA and Ed25519, and you should already have them.

  • It works but they are regenerated each time I start the sshd service. I have to check what is happening there... – Matteo Nov 16 '18 at 13:19
  • See if commenting out the entries for them makes sshd stop using them, even if they exist. – Joseph Sible Nov 16 '18 at 13:20
  • If I comment them out, they are still re-generated but not used. So fine for me :-) – Matteo Nov 16 '18 at 13:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.