bottlerocket-admin-container Evaluate disabling certain default cipher suites and key-ex algos

Evaluate disabling certain default cipher suites and key-ex algos

Open etungsten opened this issue 3 years ago • 1 comments

We should evaluate disabling some default SSH cipher suites and key algorithms that might trigger vulnerability scanning tools

Jul 13 '22 19:07 etungsten

EKS optimized AMI's sshd_config limits the cipher suites to the following by default:

Ciphers aes128-ctr,aes256-ctr,[email protected],[email protected]

We should consider doing the same. Users can still override with the admin container userdata if they wish.

Jul 13 '22 20:07 etungsten