RH10 and Kex Algos fail check

[abalzi]

Hi
I installed from scratch a RH10 and after a first check of mondoo agent I tried to fix some findings.
On of this its in the sshd configuration, I applyed the configuration suggested and the check still failed. Am I doing something wrong?
The check is "Ensure that strong Key Exchange algorithms are used" and the configuration suggested is:

KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256@libssh.org,diffie-hellman-group18-sha512

If I do a manual check with the command: sshd -T | grep -i kex I've the below output:

kexalgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512

The mondoo check result output is:

[failed] sshd.config.kexs != empty
sshd.config.kexs.containsOnly(props.mondooLinuxSecurityKexAlgos)

  [ok] value: [
    0: "ecdh-sha2-nistp256"
    1: "ecdh-sha2-nistp384"
    2: "ecdh-sha2-nistp521"
    3: "diffie-hellman-group-exchange-sha256"
    4: "diffie-hellman-group14-sha256"
    5: "diffie-hellman-group16-sha512"
    6: "diffie-hellman-group18-sha512"
  ]
  [failed] [].containsOnly()
    expected: == _
    actual:   [
      0: "ecdh-sha2-nistp256"
      1: "ecdh-sha2-nistp384"
      2: "ecdh-sha2-nistp521"
      3: "diffie-hellman-group-exchange-sha256"
      4: "diffie-hellman-group14-sha256"
      5: "diffie-hellman-group16-sha512"
    ]

[alayshia]

Hello @abalzi,

Can you verify the version of openssh-server and which policy you are using? The Ensure that strong Key Exchange algorithms are used check examines the configuration based on the OpenSSH version and looks for only those entries.