🛡️ Manual Mitigation - OpenSSH CVE-2025-26465 & CVE-2025-26466

🔍 About the Script

This script applies manual mitigations for security issues in OpenSSH, without the need for immediate update.

🚨 CVE-2025-26465

Removes VerifyHostKeyDNS to prevent SSH connection interception.

🚨 CVE-2025-26466

Adjusts MaxStartups to prevent pre-authentication DoS attacks.

---

📜 How to Use the Script

1 - Applying the Automatic Fix with wget

wget -O mitigacao-openssh.sh https://raw.githubusercontent.com/dolutech/patch-manual-CVE-2025-26465-e-CVE-2025-26466/refs/heads/main/mitigacao-openssh.sh && chmod +x mitigacao-openssh.sh && sudo ./mitigacao-openssh.sh

2 - Applying the Automatic Fix with curl

curl -o mitigacao-openssh.sh https://raw.githubusercontent.com/dolutech/patch-manual-CVE-2025-26465-e-CVE-2025-26466/refs/heads/main/mitigacao-openssh.sh && chmod +x mitigacao-openssh.sh && sudo ./mitigacao-openssh.sh

🛑 Important Notes

• This mitigation does not replace a full OpenSSH update, which should be done as soon as possible.
• The sshd_config backup will be saved with a timestamp to prevent data loss.
• If there are errors when restarting SSH, manually check the file /etc/ssh/sshd_config.

📌 Developed by:
👤 Lucas Catão de Moraes
🌍 https://cataodemoraes.com | https://dolutech.com