# Ensure sshd Ciphers are configured

Necessity: The `Ciphers` directive in the SSH server configuration specifies the cryptographic algorithms used to encrypt session data. Allowing weak or compromised ciphers (e.g., RC4, 3DES, or those using CBC mode) creates a severe security risk, as attackers could potentially decrypt sensitive traffic, leading to data exposure, credential theft, or session hijacking. Enforcing a list of strong, modern ciphers is critical for protecting the confidentiality and integrity of all SSH communications.

Auditing and Remediation: The audit script inspects the `/etc/ssh/sshd_config` file to determine the currently configured list of ciphers for the SSH daemon. The remediation script modifies this same file, either by updating the existing `Ciphers` line or adding it if it's not present, to enforce a specific, secure list of cryptographic algorithms provided as an argument.

Recommended State Rationale:
- **Basic:** This state aligns with security benchmarks like CIS, providing a strong baseline by removing obsolete ciphers. It includes modern AEAD (Authenticated Encryption with Associated Data) ciphers like ChaCha20-Poly1305 and AES-GCM, while retaining widely compatible AES-CTR for broader client support.
- **Moderate:** This state improves upon Basic by removing the non-AEAD AES-CTR ciphers. It exclusively permits AEAD ciphers, which provide both encryption and message integrity checks simultaneously, offering superior protection against certain types of cryptographic attacks compared to CTR mode.
- **Strict:** This state represents the highest level of security by limiting the ciphers to only the most robust and performant options: ChaCha20-Poly1305 and AES-256-GCM. This minimizes the cryptographic attack surface and is suitable for high-security environments where compatibility with older clients is not a concern.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr']` |
| **Moderate** | `['chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com']` |
| **Strict** | `['chacha20-poly1305@openssh.com,aes256-gcm@openssh.com']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that reads the `/etc/ssh/sshd_config` file and extracts the value of the `Ciphers` setting. The script should return only the comma-separated string of configured ciphers, with no extra text or labels.

## Remediation Script Working

bash script that takes a single command-line argument representing the desired comma-separated string of SSH ciphers. The script should modify the `/etc/ssh/sshd_config` file to set the `Ciphers` directive to this value. It must return `true` if the change is successful and `false` otherwise.

