今天幫忙處理一個漏洞，安全檢測原文描述為：
引擎檢測到遠程SSH服務器配置為使用Arcfour流密碼或根本不使用密碼。由於弱密碼的問題，RFC 4253建議不要使用Arcfour。
很少見，以前沒見過，不知道是不是新的
查閱了相關資料，是加密算法問題
查詢指定目標主機sshd支持的加密算法：encryption_algorithms
zhangwei@zhangwei:~$ nmap --script "ssh2*" 192.168.1.1
Starting Nmap 7.60 ( https://nmap.org ) at 2021-02-03 15:36 CST
Nmap scan report for bogon (192.168.1.1)
Host is up (0.039s latency).
Not shown: 998 closed ports
PORT STATE SERVICE
22/tcp open ssh
| ssh2-enum-algos:
| kex_algorithms: (4)
| diffie-hellman-group-exchange-sha256
| diffie-hellman-group-exchange-sha1
| diffie-hellman-group14-sha1
| diffie-hellman-group1-sha1
| server_host_key_algorithms: (2)
| ssh-rsa
| ssh-dss
| encryption_algorithms: (13)
| aes128-ctr
| aes192-ctr
| aes256-ctr
| arcfour256
| diffie-hellman-group-exchange-sha256
| diffie-hellman-group-exchange-sha1
| diffie-hellman-group14-sha1
| diffie-hellman-group1-sha1
| server_host_key_algorithms: (2)
| ssh-rsa
| ssh-dss
| encryption_algorithms: (13)
| aes128-ctr
| aes192-ctr
| aes256-ctr
| arcfour256
| arcfour128
| aes128-cbc
| 3des-cbc
| blowfish-cbc
| cast128-cbc
| aes192-cbc
| aes256-cbc
| arcfour
| aes128-cbc
| 3des-cbc
| blowfish-cbc
| cast128-cbc
| aes192-cbc
| aes256-cbc
| arcfour
| rijndael-cbc@lysator.liu.se
| mac_algorithms: (9)
| hmac-md5
| hmac-sha1
| umac-64@openssh.com
| hmac-sha2-256
| hmac-sha2-512
| hmac-ripemd160
| hmac-ripemd160@openssh.com
| hmac-sha1-96
| hmac-md5-96
| compression_algorithms: (2)
| none
|_ zlib@openssh.com
23/tcp filtered telnet
Nmap done: 1 IP address (1 host up) scanned in 2.06 seconds
其中包含了被認為不安全的 arcfour,arcfour-128,arcfour-256
gg了一下加密算法可以通過Ciphers執行，而sshd_config中默認是沒有相關配置的。所以直接問man吧。
man 5 sshd_config
檢索到下列內容
把 arcfour 相關的幾個拎出來刪除，形成新的配置，追加到 /etc/ssh/sshd_config 中
Ciphers 3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,blowfish-cbc,rijndael-cbc@lysator.liu.se,cast128-cbc
在 service sshd restart 后，通過 nmap 工具再次查詢。嗯，沒有了。