# Ensure sshd KexAlgorithms is configured

The SSH Key Exchange (Kex) algorithms are used during the initial connection setup to securely agree upon a shared secret key, which then encrypts the entire session. The necessity of configuring a strong set of Kex algorithms is to protect against cryptographic attacks that could allow an adversary to decrypt session traffic or perform a man-in-the-middle attack. Permitting weak or legacy algorithms (such as those based on SHA-1 or smaller Diffie-Hellman groups) exposes the connection to risks from attackers with significant computational power. The audit script verifies the currently active Kex algorithms by querying the running SSH daemon's configuration. The remediation script directly modifies the '/etc/ssh/sshd_config' file to enforce a specific list of approved algorithms and restarts the service. The rationale for the recommended states is as follows: 'Basic' provides a secure baseline by removing all known weak algorithms and mandating modern elliptic curve and group exchange methods. 'Moderate' improves upon this by removing the more generic 'diffie-hellman-group-exchange-sha256', which can be slower and potentially weaker if not configured with strong parameters, focusing instead on the well-defined and performant elliptic curve algorithms. 'Strict' represents the highest level of security by prioritizing the most modern, efficient, and secure algorithms like 'curve25519' and including 'sntrup761x25519-sha512@openssh.com', a post-quantum algorithm designed to provide protection against future threats from quantum computers.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256']` |
| **Moderate** | `['curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521']` |
| **Strict** | `['sntrup761x25519-sha512@openssh.com,curve25519-sha256@libssh.org,curve25519-sha256']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the active SSH daemon configuration for the 'KexAlgorithms' setting. The script must use 'sshd -T | grep -i '^kexalgorithms' | awk '{print $2}' ' to extract and output only the comma-separated list of algorithms, with no labels or additional text.

## Remediation Script Working

Bash script that accepts a single command-line argument: a comma-separated string of SSH Key Exchange Algorithms. The script must update the 'KexAlgorithms' setting in '/etc/ssh/sshd_config'. If the setting already exists, it must be replaced; otherwise, it must be added to the file. After updating the configuration, the script must restart the 'sshd' service to apply the changes. The script must output 'true' on success and 'false' if any step fails.

