centos7 OpenSSL ‘Diffie-Hellman key-exchange’安全漏洞
KexAlgorithms
Specifies the available KEX (Key Exchange) algorithms. #指定可用的KEX(**交换)算法。
Multiple algorithms must be comma-separated. #多个算法必须用逗号分隔。
The default is #以下为默认算法
ecdh-sha2-nistp256 ,
ecdh-sha2-nistp384 ,
ecdh-sha2-nistp521 ,
diffie-hellman-group-exchange-sha256 ,
diffie-hellman-group-exchange-sha1 ,
diffie-hellman-group14-sha1 ,
diffie-hellman-group1-sha1 .
| 缺陷 |
|---|
diffic-hellman-group1-sha1 和diffie-hellman-group-exchange-sha1的长度只有1024位，被认为是弱**交换算法
| 解决方法 |
|---|
vim /etc/ssh/sshd_config
在文本结尾新增配置如下：
kexalgorithms curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
保存退出重启sshd服务
：wq
systemclt restart sshd