本次弱掃有關SSH出現以下二個中風險

The remote SSH server is configured to allow / support weak key

exchange (KEX) algorithm(s).

Detection Result

The remote SSH server supports the following weak KEX algorithm(s):

KEX algorithm                      | Reason

------------------------------------------------

diffie-hellman-group-exchange-sha1 | Using SHA-1

The remote SSH server is configured to allow / support weak

encryption algorithm(s).

Detection Result

The remote SSH server supports the following weak client-to-server encryption algorithm(s):

aes128-cbc

aes256-cbc

解決方式是在 /etc/ssh/sshd_config

加入以下二行

Ciphers aes128-ctr,aes192-ctr,aes256-ctr

KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1

重新啟動daemon

https://serverfault.com/questions/758673/how-to-disable-diffie-hellman-group1-sha1-for-ssh

http://www.vixual.net/blog/archives/64

今天要ssh 到server時出現錯誤

ssh root@10.1.1.1

Bad packet length 1657225410.

ssh_dispatch_run_fatal: Connection to 10.1.1.1 port 22: Connection corrupted

log出現以下錯誤

Feb  3 08:10:34 mail sshd[2963]: Bad packet length 1492758558. [preauth]

Feb  3 08:10:34 mail sshd[2963]: ssh_dispatch_run_fatal: Connection from 10.1.1.2 port 38462: Connection corrupted [preauth]

最新沒改設定 是不是有更新 查了一下

2024-02-03T02:05:13+0800 DEBUG Upgraded: openssh-server-8.0p1-19.el8_9.2.x86_64

果然沒錯

但要怎麼解決呢

這台是少數在用的几台 oracle linux 8

google 了一下果然有人也碰到問題

有人提出解法

ssh -c aes256-gcm@openssh.com user@host.example.com

試了一下沒問題

或是將 aes256-gcm@openssh.com 加到 /etc/ssh/ssh_config裡的 Ciphers 的這行

如下

Ciphers aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc

https://superuser.com/questions/1828501/how-to-solve-ssh-connection-corrupted-error