Advanced Search
Search Results
176 total results found
Remediation Steps
Follow the steps below to remediate this finding on Linux (Debian/Ubuntu). Edit /etc/ssh/sshd_config and restrict the Ciphers directive to exclude CBC mode ciphers:Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-...
Remediation Steps
Follow the steps below to remediate this finding on Linux (RHEL/CentOS/AlmaLinux). Edit /etc/ssh/sshd_config and restrict the Ciphers directive:Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com...
Remediation Steps
Follow the steps below to remediate this finding on Windows. For Win32-OpenSSH, edit C:\ProgramData\ssh\sshd_config (or %PROGRAMDATA%\ssh\sshd_config).Add or update the Ciphers directive to exclude CBC ciphers:Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gc...
Remediation Steps
Follow the steps below to remediate this finding on Linux (Debian/Ubuntu). The Terrapin attack requires both ChaCha20-Poly1305 or CBC with Encrypt-then-MAC AND the use of prefix truncation during handshake.The primary fix is to update OpenSSH to a version that...
Remediation Steps
Follow the steps below to remediate this finding on Linux (RHEL/CentOS/AlmaLinux). Update OpenSSH to 9.6+ if available:sudo dnf update openssh-server openssh-clientsIf the update is not available, disable the affected algorithms in /etc/ssh/sshd_config:Ciphers...
Remediation Steps
Follow the steps below to remediate this finding on Windows. Update Win32-OpenSSH to version 9.6 or later.If an update is unavailable, edit sshd_config to disable the affected algorithms:Ciphers -chacha20-poly1305@openssh.com MACs -hmac-sha2-256-etm@openssh.co...
Remediation Steps
Follow the steps below to remediate this finding on Linux (Debian/Ubuntu). Edit /etc/ssh/sshd_config and restrict the KexAlgorithms directive to strong algorithms:KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp38...
Remediation Steps
Follow the steps below to remediate this finding on Linux (RHEL/CentOS/AlmaLinux). Edit /etc/ssh/sshd_config and restrict the KexAlgorithms directive:KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-n...
Remediation Steps
Follow the steps below to remediate this finding on Windows. Edit C:\ProgramData\ssh\sshd_config and add or update:KexAlgorithms curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha...
Remediation Steps
Follow the steps below to remediate this finding on Microsoft IIS webserver. Use IIS Crypto (free tool) to disable anonymous (NULL) cipher suites.Open IIS Crypto, select the "Best Practices" template or manually uncheck all cipher suites containing "ANON" or "...
Remediation Steps
Follow the steps below to remediate this finding on Nginx webserver. In your nginx.conf, configure ssl_ciphers to exclude anonymous and NULL suites:ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AE...
Remediation Steps
Follow the steps below to remediate this finding on Apache webserver. In your Apache SSL configuration (e.g., ssl.conf or VirtualHost), set:SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-...
Remediation Steps
Follow the steps below to remediate this finding on Plesk. Log in to the Plesk control panel.Navigate to Domains > your domain > SSL/TLS Certificates.Use the SSL/TLS settings to configure allowed cipher suites, or navigate to Apache & nginx Settings and add th...
Remediation Steps
Follow the steps below to remediate this finding on Microsoft IIS webserver. Obtain a certificate from a publicly trusted Certificate Authority (CA) such as Let's Encrypt, DigiCert, or Sectigo.In IIS Manager, select your site and click Bindings.Edit the HTTPS ...
Remediation Steps
Follow the steps below to remediate this finding on Nginx webserver. Obtain a certificate from a trusted CA. For Let's Encrypt, use Certbot:sudo apt install certbot python3-certbot-nginx sudo certbot --nginx -d yourdomain.comIn nginx.conf, configure:ssl_certif...
Remediation Steps
Follow the steps below to remediate this finding on Apache webserver. Obtain a certificate from a trusted CA. For Let's Encrypt:sudo apt install certbot python3-certbot-apache sudo certbot --apache -d yourdomain.comIn the Apache SSL VirtualHost, configure:SSLC...
Remediation Steps
Follow the steps below to remediate this finding on Plesk. In the Plesk control panel, navigate to Domains > your domain > SSL/TLS Certificates.Click the Let's Encrypt button to obtain a free trusted certificate, or click Add SSL/TLS Certificate to upload a ce...
Remediation Steps
Follow the steps below to remediate this finding on Microsoft IIS webserver. Renew the certificate before it expires.For certificates from a commercial CA, request a renewal from your CA portal and import the new certificate.In IIS Manager, go to Server Certif...