Updated kex algo, ciphers, macs recording to BSI TR-02102-4

elan-ev · Jan 10, 2024 · 5bd0765 · 5bd0765
1 parent f8c5296
commit 5bd0765
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/tasks/main.yml b/tasks/main.yml
@@ -14,11 +14,11 @@
     - regexp: '^PermitRootLogin '
       line: 'PermitRootLogin prohibit-password'
     - regexp: '^KexAlgorithms '
-      line: 'KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256'
+      line: 'KexAlgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512, ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256'
     - regexp: '^Ciphers '
-      line: 'Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'
+      line: 'Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'
     - regexp: '^MACs '
-      line: 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com'
+      line: 'MACs hmac-sha2-512,hmac-sha2-256'
   notify: reload sshd
 
 - name: disable globaly crypot config for sshd