# Ensure sshd Ciphers are configured

The SSH `Ciphers` directive specifies the cryptographic algorithms used for encrypting the data stream. Restricting this list to strong, modern ciphers is critical for protecting the confidentiality and integrity of data in transit. Weak or compromised ciphers (e.g., RC4, 3DES, or any using CBC mode) are vulnerable to cryptographic attacks that could allow an attacker to decrypt session traffic, exposing sensitive credentials and commands. The audit script verifies which ciphers are currently permitted by parsing the `/etc/ssh/sshd_config` file. The remediation script modifies this file to enforce a specific, secure list of ciphers. The Basic state provides a strong baseline, removing known weak ciphers while maintaining broad compatibility. The Moderate state improves security by exclusively using Authenticated Encryption with Associated Data (AEAD) ciphers, which provide both confidentiality and integrity protection. The Strict state offers maximum security by limiting the list to only the most modern and performant ciphers, minimizing the cryptographic attack surface.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr']` |
| **Moderate** | `['chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com']` |
| **Strict** | `['chacha20-poly1305@openssh.com,aes256-gcm@openssh.com']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that queries the `/etc/ssh/sshd_config` file for the `Ciphers` setting. The script must parse the file to find the line beginning with `Ciphers` (case-insensitive and ignoring leading whitespace) and return only the configured value (the string of ciphers). If the setting is not present or commented out, the script should return an empty string.

## Remediation Script Working

bash script that accepts a single, comma-separated string of ciphers as a positional command-line argument. The script must update the `Ciphers` setting in `/etc/ssh/sshd_config` with the provided value. If the setting already exists (commented or not), it should be replaced; if it does not exist, it should be added to the file. The script must return `true` on successful application of the setting and `false` on failure.

