>From e293c7b812c42f43d294c1efbfbbdea4e9de88e9 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 7 Sep 2013 11:29:11 -0400 Subject: [PATCH 04/13] New remediation: sshd_use_approved_ciphers testing: Testing on /etc/ssh/sshd_config with no Ciphers value set: [root@rhel6 bash]# grep Ciphers /etc/ssh/sshd_config ; bash sshd_use_approved_ciphers.sh ; grep Ciphers /etc/ssh/sshd_config Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc Testing with incorrect Ciphers value: [root@rhel6 bash]# sed -i "s/Ciphers.*/Ciphers WRONG STRING/g" /etc/ssh/sshd_config [root@rhel6 bash]# grep Ciphers /etc/ssh/sshd_config ; bash sshd_use_approved_ciphers.sh ; grep Ciphers /etc/ssh/sshd_config Ciphers WRONG STRING Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc --- .../input/fixes/bash/sshd_use_approved_ciphers.sh | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) create mode 100644 RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh diff --git a/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh new file mode 100644 index 0000000..a00eb95 --- /dev/null +++ b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh @@ -0,0 +1,5 @@ +grep -q ^Ciphers /etc/ssh/sshd_config && \ + sed -i "s/Ciphers.*/Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/g" /etc/ssh/sshd_config +if ! [ $? -eq 0 ]; then + echo "Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc" >> /etc/ssh/sshd_config +fi -- 1.7.1