這是Nessus掃出的「SSH弱式金鑰演算法已啟用」的弱點，解法是在config檔移除相關弱點。但和Regex有啥關聯？因為弱式演算法有很多個，config格式也特殊，用vi編輯容易打錯且加深近視，且UAT和PROD的config也不全然相同，所以就過渡兩個Linux Command處理。
根據修正建議，要在以下兩個config檔移除弱式演算法：

/etc/crypto-policies/back-ends/openssh.config
/etc/crypto-policies/back-ends/opensshserver.config

要移除的弱點演算法如下：

aes128-cbc
aes256-cbc
chacha20-poly1305@openssh.com
diffie-hellman-group-exchange-sha1
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1 
gss-gex-sha1-
gss-group1-sha1-
gss-group14-sha1-
hmac-sha1-etm@openssh.com
hmac-sha2-256-etm@openssh.com
hmac-sha2-512-etm@openssh.com
umac-128-etm@openssh.com

然而，這兩個檔案格式特殊
openssh.config長相如下：共分Ciphers、MACs、GSSAPIKexAlgorithms、KexAlgorithms、PubkeyAcceptedKeyTypes及CASignatureAlgorithms六大區塊

Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr
MACs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
GSSAPIKexAlgorithms gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-,gss-gex-sha1-,gss-group14-sha1-
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1
PubkeyAcceptedKeyTypes ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com
CASignatureAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-256,rsa-sha2-512,ssh-rsa

而opensshserver.config卻是一行字串，用引號括起參數，-o接區塊名稱如下：

CRYPTO_POLICY='-oCiphers=aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr -oMACs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 -oGSSAPIKexAlgorithms=gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-,gss-gex-sha1-,gss-group14-sha1- -oKexAlgorithms=curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com -oPubkeyAcceptedKeyTypes=ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com -oCASignatureAlgorithms=ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-256,rsa-sha2-512,ssh-rsa

解決方式：大家若有常用的文字編輯器，大都有Regex替換功能，而筆者慣用Sublime，所以要替換兩項：

• 搜尋pattern是\n，替換內容是|。
• 搜尋pattern是.，替換內容是\.。
  再用替換結果組成以下要過版的指令，以opensshserver.config為例，另一個openssh.config相對簡單，邦友可以自行組裝：

# 用egrep檢查config有無弱式演算法，若有結果回傳，請用下個指令進行替換。
egrep '(aes128-cbc|aes256-cbc|chacha20-poly1305@openssh\.com|diffie-hellman-group-exchange-sha1|diffie-hellman-group1-sha1|diffie-hellman-group14-sha1|gss-gex-sha1-|gss-group1-sha1-|gss-group14-sha1-|hmac-sha1-etm@openssh\.com|hmac-sha2-256-etm@openssh\.com|hmac-sha2-512-etm@openssh\.com|umac-128-etm@openssh\.com)' opensshserver.config

# 使用sed用Regex替換config內容到new_config，其中演算法後接的逗號給予量詞?
sed -E 's/(aes128-cbc|aes256-cbc|chacha20-poly1305@openssh\.com|diffie-hellman-group-exchange-sha1|diffie-hellman-group1-sha1|diffie-hellman-group14-sha1|gss-gex-sha1-|gss-group1-sha1-|gss-group14-sha1-|hmac-sha1-etm@openssh\.com|hmac-sha2-256-etm@openssh\.com|hmac-sha2-512-etm@openssh\.com|umac-128-etm@openssh\.com),?//g' opensshserver.config > new_opensshserver.config

# 用egrep檢查new_config有無弱式演算法，若沒有搜尋結果，表示替換成功。
egrep '(aes128-cbc|aes256-cbc|chacha20-poly1305@openssh\.com|diffie-hellman-group-exchange-sha1|diffie-hellman-group1-sha1|diffie-hellman-group14-sha1|gss-gex-sha1-|gss-group1-sha1-|gss-group14-sha1-|hmac-sha1-etm@openssh\.com|hmac-sha2-256-etm@openssh\.com|hmac-sha2-512-etm@openssh\.com|umac-128-etm@openssh\.com)' new_opensshserver.config

但還不急將new_config改回config，因為每台主機設定未必相同，請vi new_config，這肉眼可查，以new_opensshserver.config為例，可以搜尋「, -o」，應該會有，再請手動將逗號移除存檔，然後new_opensshserver.config改回opensshserver.config。
另一個new_openssh.config，則是搜尋「,\n」或「,$」但其實在vi就肉眼可見換行有沒有以逗號結尾，有逗號結尾就拿掉逗號再存檔，然後new_openssh.config蓋到openssh.config。
最後再重啟sshd服務：

sudo systemctl restart sshd