Skip to main content
Advanced Search
Search Terms
Content Type

Exact Matches
Tag Searches
Date Options
Updated after
Updated before
Created after
Created before

Search Results

395 total results found

Remediation Steps

SSH Terrapin Prefix Truncation Weakness... Windows

Follow the steps below to remediate this finding on Windows. Update Win32-OpenSSH to version 9.6 or later.If an update is unavailable, edit sshd_config to disable the affected algorithms:Ciphers -chacha20-poly1305@openssh.com MACs -hmac-sha2-256-etm@openssh.co...

Linux (Debian/Ubuntu)

SSH Weak Key Exchange Algorithms Enabled

Remediation Steps

SSH Weak Key Exchange Algorithms Enabled Linux (Debian/Ubuntu)

Follow the steps below to remediate this finding on Linux (Debian/Ubuntu). Edit /etc/ssh/sshd_config and restrict the KexAlgorithms directive to strong algorithms:KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp38...

Linux (RHEL/CentOS/AlmaLinux)

SSH Weak Key Exchange Algorithms Enabled

Remediation Steps

SSH Weak Key Exchange Algorithms Enabled Linux (RHEL/CentOS/AlmaLinux)

Follow the steps below to remediate this finding on Linux (RHEL/CentOS/AlmaLinux). Edit /etc/ssh/sshd_config and restrict the KexAlgorithms directive:KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-n...

Windows

SSH Weak Key Exchange Algorithms Enabled

Remediation Steps

SSH Weak Key Exchange Algorithms Enabled Windows

Follow the steps below to remediate this finding on Windows. Edit C:\ProgramData\ssh\sshd_config and add or update:KexAlgorithms curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha...

Microsoft IIS webserver

SSL Anonymous Cipher Suites Supported

Remediation Steps

SSL Anonymous Cipher Suites Supported Microsoft IIS webserver

Follow the steps below to remediate this finding on Microsoft IIS webserver. Use IIS Crypto (free tool) to disable anonymous (NULL) cipher suites.Open IIS Crypto, select the "Best Practices" template or manually uncheck all cipher suites containing "ANON" or "...

Nginx webserver

SSL Anonymous Cipher Suites Supported

Remediation Steps

SSL Anonymous Cipher Suites Supported Nginx webserver

Follow the steps below to remediate this finding on Nginx webserver. In your nginx.conf, configure ssl_ciphers to exclude anonymous and NULL suites:ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AE...

Apache webserver

SSL Anonymous Cipher Suites Supported

Remediation Steps

SSL Anonymous Cipher Suites Supported Apache webserver

Follow the steps below to remediate this finding on Apache webserver. In your Apache SSL configuration (e.g., ssl.conf or VirtualHost), set:SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-...

Plesk

SSL Anonymous Cipher Suites Supported

Remediation Steps

SSL Anonymous Cipher Suites Supported Plesk

Follow the steps below to remediate this finding on Plesk. Log in to the Plesk control panel.Navigate to Domains > your domain > SSL/TLS Certificates.Use the SSL/TLS settings to configure allowed cipher suites, or navigate to Apache & nginx Settings and add th...

Microsoft IIS webserver

SSL Certificate Cannot Be Trusted

Remediation Steps

SSL Certificate Cannot Be Trusted Microsoft IIS webserver

Follow the steps below to remediate this finding on Microsoft IIS webserver. Obtain a certificate from a publicly trusted Certificate Authority (CA) such as Let's Encrypt, DigiCert, or Sectigo.In IIS Manager, select your site and click Bindings.Edit the HTTPS ...

Nginx webserver

SSL Certificate Cannot Be Trusted