Skip to content

Remove rule sshd_use_strong_kex from CIS profiles #14262

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mab879 merged 1 commit into from
Jan 5, 2026
Merged

Remove rule sshd_use_strong_kex from CIS profiles #14262

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions products/rhel10/controls/cis_rhel10.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1695,13 +1695,11 @@ controls:
levels:
- l1_server
- l1_workstation
status: pending
status: not applicable
notes: |-
The status was automated but we need to double check the approach used in this rule.
Therefore I moved it to pending until deeper investigation.
rules:
- sshd_use_strong_kex
- sshd_strong_kex=cis_rhel10
This CIS requirement shall be notapplicable on RHEL 10. The CIS
Benchmark requires disabling the weak SHA1 key exchange algorithms,
but RHEL 10 doesn't provide these algorithms.

- id: 5.1.13
title: Ensure sshd LoginGraceTime is configured (Automated)
Expand Down
1 change: 1 addition & 0 deletions products/rhel10/profiles/default.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ description: |-
this profile is to keep a rule in the product's XCCDF Benchmark.

selections:
- sshd_use_strong_kex
- grub2_nousb_argument
- audit_rules_kernel_module_loading_create
- grub2_uefi_admin_username
Expand Down
8 changes: 6 additions & 2 deletions products/rhel8/controls/cis_rhel8.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1545,9 +1545,13 @@ controls:
- l1_server
- l1_workstation
status: automated
notes: |-
We don't select rule sshd_use_strong_kex because the CIS Benchmark
recommends using system-wide crypto policies to disable the weak
SHA1 key exchange algorithms instead of configuring KexAlgorithms
in sshd configuration.
rules:
- sshd_use_strong_kex
- sshd_strong_kex=cis_rhel8
- configure_custom_crypto_policy_cis

- id: 4.2.12
title: Ensure sshd LoginGraceTime is configured (Automated)
Expand Down
11 changes: 6 additions & 5 deletions products/rhel9/controls/cis_rhel9.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1517,13 +1517,14 @@ controls:
levels:
- l1_server
- l1_workstation
status: pending
status: automated
notes: |-
The status was automated but we need to double check the approach used in this rule.
Therefore I moved it to pending until deeper investigation.
We don't select rule sshd_use_strong_kex because the CIS Benchmark
recommends using system-wide crypto policies to disable the weak
SHA1 key exchange algorithms instead of configuring KexAlgorithms
in sshd configuration.
rules:
- sshd_use_strong_kex
- sshd_strong_kex=cis_rhel9
- configure_custom_crypto_policy_cis

- id: 5.1.6
title: Ensure sshd MACs are configured (Automated)
Expand Down
1 change: 1 addition & 0 deletions products/rhel9/profiles/default.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ description: |-
is to keep a rule in the product's XCCDF Benchmark.

selections:
- sshd_use_strong_kex
- sebool_nfsd_anon_write
- sebool_squid_connect_any
- sebool_polipo_connect_all_unreserved
Expand Down
2 changes: 0 additions & 2 deletions tests/data/profile_stability/rhel10/cis.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -395,8 +395,6 @@ sshd_set_loglevel_verbose
sshd_set_max_auth_tries
sshd_set_max_sessions
sshd_set_maxstartups
sshd_strong_kex=cis_rhel10
sshd_use_strong_kex
sudo_add_use_pty
sudo_custom_logfile
sudo_remove_no_authenticate
Expand Down
2 changes: 0 additions & 2 deletions tests/data/profile_stability/rhel10/cis_server_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -286,8 +286,6 @@ sshd_set_loglevel_verbose
sshd_set_max_auth_tries
sshd_set_max_sessions
sshd_set_maxstartups
sshd_strong_kex=cis_rhel10
sshd_use_strong_kex
sudo_add_use_pty
sudo_custom_logfile
sudo_remove_no_authenticate
Expand Down
2 changes: 0 additions & 2 deletions tests/data/profile_stability/rhel10/cis_workstation_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -279,8 +279,6 @@ sshd_set_loglevel_verbose
sshd_set_max_auth_tries
sshd_set_max_sessions
sshd_set_maxstartups
sshd_strong_kex=cis_rhel10
sshd_use_strong_kex
sudo_add_use_pty
sudo_custom_logfile
sudo_remove_no_authenticate
Expand Down
2 changes: 0 additions & 2 deletions tests/data/profile_stability/rhel10/cis_workstation_l2.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -391,8 +391,6 @@ sshd_set_loglevel_verbose
sshd_set_max_auth_tries
sshd_set_max_sessions
sshd_set_maxstartups
sshd_strong_kex=cis_rhel10
sshd_use_strong_kex
sudo_add_use_pty
sudo_custom_logfile
sudo_remove_no_authenticate
Expand Down
2 changes: 0 additions & 2 deletions tests/data/profile_stability/rhel8/cis.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -369,8 +369,6 @@ sshd_set_loglevel_verbose
sshd_set_max_auth_tries
sshd_set_max_sessions
sshd_set_maxstartups
sshd_strong_kex=cis_rhel8
sshd_use_strong_kex
sudo_add_use_pty
sudo_custom_logfile
sudo_require_authentication
Expand Down
2 changes: 0 additions & 2 deletions tests/data/profile_stability/rhel8/cis_server_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -270,8 +270,6 @@ sshd_set_loglevel_verbose
sshd_set_max_auth_tries
sshd_set_max_sessions
sshd_set_maxstartups
sshd_strong_kex=cis_rhel8
sshd_use_strong_kex
sudo_add_use_pty
sudo_custom_logfile
sudo_require_authentication
Expand Down
2 changes: 0 additions & 2 deletions tests/data/profile_stability/rhel8/cis_workstation_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,8 +265,6 @@ sshd_set_loglevel_verbose
sshd_set_max_auth_tries
sshd_set_max_sessions
sshd_set_maxstartups
sshd_strong_kex=cis_rhel8
sshd_use_strong_kex
sudo_add_use_pty
sudo_custom_logfile
sudo_require_authentication
Expand Down
2 changes: 0 additions & 2 deletions tests/data/profile_stability/rhel8/cis_workstation_l2.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -365,8 +365,6 @@ sshd_set_loglevel_verbose
sshd_set_max_auth_tries
sshd_set_max_sessions
sshd_set_maxstartups
sshd_strong_kex=cis_rhel8
sshd_use_strong_kex
sudo_add_use_pty
sudo_custom_logfile
sudo_require_authentication
Expand Down
2 changes: 0 additions & 2 deletions tests/data/profile_stability/rhel9/cis.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -366,8 +366,6 @@ sshd_set_loglevel_verbose
sshd_set_max_auth_tries
sshd_set_max_sessions
sshd_set_maxstartups
sshd_strong_kex=cis_rhel9
sshd_use_strong_kex
sudo_add_use_pty
sudo_custom_logfile
sudo_require_authentication
Expand Down
2 changes: 0 additions & 2 deletions tests/data/profile_stability/rhel9/cis_server_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,8 +263,6 @@ sshd_set_loglevel_verbose
sshd_set_max_auth_tries
sshd_set_max_sessions
sshd_set_maxstartups
sshd_strong_kex=cis_rhel9
sshd_use_strong_kex
sudo_add_use_pty
sudo_custom_logfile
sudo_require_reauthentication
Expand Down
2 changes: 0 additions & 2 deletions tests/data/profile_stability/rhel9/cis_workstation_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,8 +257,6 @@ sshd_set_loglevel_verbose
sshd_set_max_auth_tries
sshd_set_max_sessions
sshd_set_maxstartups
sshd_strong_kex=cis_rhel9
sshd_use_strong_kex
sudo_add_use_pty
sudo_custom_logfile
sudo_require_reauthentication
Expand Down
2 changes: 0 additions & 2 deletions tests/data/profile_stability/rhel9/cis_workstation_l2.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -362,8 +362,6 @@ sshd_set_loglevel_verbose
sshd_set_max_auth_tries
sshd_set_max_sessions
sshd_set_maxstartups
sshd_strong_kex=cis_rhel9
sshd_use_strong_kex
sudo_add_use_pty
sudo_custom_logfile
sudo_require_authentication
Expand Down
Loading