Diffie-Hellman Key Agreement Protocol 资源管理错误漏洞 (CVE-2002-20001)

搜了搜bing打算关闭这个Diffie-Hellman Key

1. 查看当前openssl版本(没啥用)

openssl version

2. 查看当前SecureCRT版本(没啥用)

略

3. 给sshd_config添加内容

echo "KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group1-sha256,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha256,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha512" >> /etc/ssh/sshd_config

参考
https://github.com/c0r0n3r/dheater
https://www.cnblogs.com/autopwn/p/16363160.html

4. 重新加载sshd,并查看服务端支持协议是否少了diffie部分

systemctl restart sshd
sshd -T | grep -w kexalgorithms

5. 断开连接后无法连接

重新加载sshd

systemctl restart sshd