修复SSH 服务支持弱加密算法漏洞

目标机器版本信息

[root@localhost ~]# ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017

验证安装nmap

[root@localhost ~]# sudo yum install nmap

 扫描命令

sudo nmap --script ssh2-enum-algos -p 22 192.168.3.207

扫描结果 

[root@localhost ~]# nmap --script ssh2-enum-algos -sV -p 22 192.168.3.207Starting Nmap 6.40 ( http://nmap.org ) at 2025-05-27 14:49 CST
Nmap scan report for 192.168.3.207
Host is up (0.00067s latency).
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.4 (protocol 2.0)
| ssh2-enum-algos:
|   kex_algorithms (12)
|       curve25519-sha256
|       [e-mail]
|       ecdh-sha2-nistp256
|       ecdh-sha2-nistp384
|       ecdh-sha2-nistp521
|       diffie-hellman-group-exchange-sha256
|       diffie-hellman-group16-sha512
|       diffie-hellman-group18-sha512
|       diffie-hellman-group-exchange-sha1
|       diffie-hellman-group14-sha256
|       diffie-hellman-group14-sha1
|       diffie-hellman-group1-sha1
|   server_host_key_algorithms (5)
|       ssh-rsa
|       rsa-sha2-512
|       rsa-sha2-256
|       ecdsa-sha2-nistp256
|       ssh-ed25519
|   encryption_algorithms (12)
|       [e-mail]
|       aes128-ctr
|       aes192-ctr
|       aes256-ctr
|       [e-mail]
|       [e-mail]
|       aes128-cbc
|       aes192-cbc
|       aes256-cbc
|       blowfish-cbc
|       cast128-cbc
|       3des-cbc
|   mac_algorithms (10)
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       hmac-sha2-256
|       hmac-sha2-512
|       hmac-sha1
|   compression_algorithms (2)
|       none
|_      [e-mail]
MAC Address: 00:0C:29:AB:7F:1D (VMware)Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.67 seconds

修改建议

临时规避办法vim /etc/ssh/sshd_config

去掉 arcfour、arcfour128、arcfour256 等弱加密算法，重启sshd

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc

----------------------------------此次以上步骤已经完成---------------------------------------- 

 若彻底解决升级openssh

[root@localhost ~]# ssh -V
OpenSSH_9.8p1, OpenSSL 3.4.0 22 Oct 2024

Starting Nmap 6.40 ( http://nmap.org ) at 2025-05-27 15:07 CST
Nmap scan report for 192.168.3.239
Host is up (0.00072s latency).
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.8 (protocol 2.0)
| ssh2-enum-algos:
|   kex_algorithms (12)
|       [e-mail]
|       curve25519-sha256
|       [e-mail]
|       ecdh-sha2-nistp256
|       ecdh-sha2-nistp384
|       ecdh-sha2-nistp521
|       diffie-hellman-group-exchange-sha256
|       diffie-hellman-group16-sha512
|       diffie-hellman-group18-sha512
|       diffie-hellman-group14-sha256
|       ext-info-s
|       [e-mail]
|   server_host_key_algorithms (4)
|       rsa-sha2-512
|       rsa-sha2-256
|       ecdsa-sha2-nistp256
|       ssh-ed25519
|   encryption_algorithms (6)
|       [e-mail]
|       aes128-ctr
|       aes192-ctr
|       aes256-ctr
|       [e-mail]
|       [e-mail]
|   mac_algorithms (10)
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       hmac-sha2-256
|       hmac-sha2-512
|       hmac-sha1
|   compression_algorithms (2)
|       none
|_      [e-mail]
MAC Address: 00:0C:29:58:FC:7A (VMware)Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.67 seconds