{{% if product in ['ol8','rhel8'] %}} {{% set path='/etc/crypto-policies/back-ends/opensshserver.config' %}} {{% set prefix_conf="^\s*CRYPTO_POLICY\s*=.*-oKexAlgorithms=" %}} {{% set kex_algos=["ecdh-sha2-nistp256","ecdh-sha2-nistp384", "ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256","diffie-hellman-group16-sha512", "diffie-hellman-group18-sha512"] %}} {{% set sufix_conf="(\s.*)?'" %}} {{% elif product in ['ol7','rhel7','sle12','sle15','ubuntu2004'] %}} {{% set path='/etc/ssh/sshd_config' %}} {{% set prefix_conf="^\s*KexAlgorithms\s*" %}} {{% set kex_algos=["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256"] %}} {{% endif %}}

{{% set kex_algos_regex=prefix_conf ~ "(?=[\w-])" "(\\b" ~ kex_algos|join("\\b,?)?(\\b") ~ ")?" ~ sufix_conf ~ "[\\s]*(?:#.*)?$" %}}

{{{ oval_metadata("Limit the Key Exchange (Kex) algorithms to those which are FIPS-approved.") }}} {{% if product in ['sle12', 'sle15'] %}} {{% else %}} {{% endif %}} {{% if product in ['sle12', 'sle15'] %}} {{% else %}} {{% endif %}}
{{{ path }}}
{{{ prefix_conf }}}.*
1
{{{ kex_algos_regex }}}