# Ensure sshd KexAlgorithms is configured

The Key Exchange (Kex) algorithms are fundamental to the SSH protocol, used to securely generate session keys for encrypting all communication after authentication. The necessity of this setting is to prevent downgrade attacks where a man-in-the-middle attacker could force the client and server to negotiate a weak or compromised algorithm, potentially allowing them to decrypt the session traffic. By explicitly defining a strong, modern set of algorithms, you eliminate legacy options with known vulnerabilities (e.g., those based on SHA-1). The audit script checks the currently active Kex algorithms by querying the running SSH server's configuration. The remediation script directly modifies the '/etc/ssh/sshd_config' file to enforce a specific list of approved algorithms and restarts the service. The recommended state rationale is as follows: 'Basic' provides a robust set of modern algorithms, including secure Elliptic Curve and Diffie-Hellman options, ensuring broad compatibility while removing unsafe defaults. 'Moderate' improves security by removing the standard NIST p256 curve and traditional Diffie-Hellman groups, prioritizing the stronger and more performant Curve25519 and higher-strength NIST curves. 'Strict' offers the most secure configuration by limiting the selection to only Curve25519 and the 521-bit NIST curve, which are widely considered the strongest and most resilient algorithms available, thus minimizing the cryptographic attack surface at the potential cost of compatibility with older clients.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256']` |
| **Moderate** | `['curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp384,ecdh-sha2-nistp521']` |
| **Strict** | `['curve25519-sha256,ecdh-sha2-nistp521']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that queries the effective SSH server configuration for the 'kexalgorithms' setting and outputs only the value. The script should use `sshd -T | grep '^kexalgorithms ' | awk '{print $2}'` to ensure only the value is returned.

## Remediation Script Working

shell script that accepts a single command-line argument representing the desired comma-separated list of SSH Key Exchange Algorithms. The script must update the 'KexAlgorithms' setting in '/etc/ssh/sshd_config' to match the provided argument. If the setting does not exist, it must be added. After successfully updating the configuration, the script must restart the sshd service and output 'true'. If any step fails, it must output 'false'.

