使用安全策略 - Amazon Transfer Family
加密算法转让安全策略2018-11 年度转让安全策略转让安全性政策
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅中国的 Amazon Web Services 服务入门。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

使用安全策略

中的服务器安全策略Amazon Transfer Family允许您限制与服务器关联的加密算法集（消息身份验证代码 (MAC)、密钥交换 (KEXs) 和密码套件）。有关受支持的加密算法的列表，请参阅加密算法.

注意

我们支持 TLS 1.2。

服务器的可用安全策略包括：

注意

  • TransferSecurityPolicy-2020-06是使用控制台创建服务器时附加到服务器的默认安全策略。

  • TransferSecurityPolicy-2018-11是使用 API 或 CLI 创建服务器时附加到服务器的默认安全策略。

加密算法

以下是每个安全策略支持的加密算法的列表。

安全策略 2020-06 FIPS-06-06 2018-11

SSH ciphers

136-CR

♦

♦

♦

aes128-gcm@openssh.com

♦

♦

♦

192-Ct

♦

♦

♦

66-CR

♦

♦

♦

aes256-gcm@openssh.com

♦

♦

♦

chacha20-poly1305@openssh.com

♦

 

♦

KEXs

差异-赫尔曼-组 14-sha256

♦

♦

♦

差异-赫尔曼-组 16-sha512

♦

♦

♦

差异-赫尔曼-组 18-沙 512

♦

♦

♦

毛里求斯共和国发展中国家科学研究所

♦

♦

♦

毛里求斯共和国发展中国家科学研究所

♦

♦

♦

差异-赫尔曼集团-交换-sha256

♦

♦

♦

差异-赫尔曼-组 14 股 1

 

 

♦

埃塞俄比亚共和国

♦

♦

♦

curve25519-sha256@libssh.org

 

 

♦

曲线 25519 沙特

 

 

♦

MACs

hmac-sha2-256-etm@openssh.com

♦

♦

♦

哈马克-Sha2-256

♦

♦

♦

hmac-sha2-512-etm@openssh.com

♦

♦

♦

哈马克-Sha2-512

♦

♦

♦

hmac-sha1-etm@openssh.com

 

 

♦

HMAC sha1

 

 

♦

umac-128-etm@openssh.com

♦

 

♦

umac-128@openssh.com

♦

 

♦

umac-64-etm@openssh.com

 

 

♦

umac-64@openssh.com

 

 

♦

TLS ciphers

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

♦

♦

♦

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

♦

♦

♦

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

♦

♦

♦

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

♦

♦

♦

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

♦

♦

♦

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

♦

♦

♦

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

♦

♦

♦

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

♦

♦

♦

TLS_RSA_WITH_AES_128_CBC_SHA256

 

 

♦

包含 256 个国家/地区国家/地区分析

 

 

♦

转让安全策略

下面显示了传输安全策略 2020-06 安全策略。此安全策略包含所有受支持但不建议使用的加密算法。这是未启用 FIPS 的服务器端点的默认安全策略。

{
  "SecurityPolicy": {
    "Fips": false,
    "SecurityPolicyName": "TransferSecurityPolicy-2020-06",
    "SshCiphers": [
      "chacha20-poly1305@openssh.com",
      "aes128-ctr",
      "aes192-ctr",
      "aes256-ctr",
      "aes128-gcm@openssh.com",
      "aes256-gcm@openssh.com"
    ],
    "SshKexs": [
      "ecdh-sha2-nistp256",
      "ecdh-sha2-nistp384",
      "ecdh-sha2-nistp521",
      "diffie-hellman-group-exchange-sha256",
      "diffie-hellman-group16-sha512",
      "diffie-hellman-group18-sha512",
      "diffie-hellman-group14-sha256"
    ],
    "SshMacs": [
      "umac-128-etm@openssh.com",
      "hmac-sha2-256-etm@openssh.com",
      "hmac-sha2-512-etm@openssh.com",
      "umac-128@openssh.com",
      "hmac-sha2-256",
      "hmac-sha2-512"
    ],
    "TlsCiphers": [
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
    ]
  }
}

2018-11 年度转让安全策略

下面显示了转移安全策略 2018-11 安全策略。此安全策略是当前所有受支持的加密算法集合。

{
  "SecurityPolicy": {
    "Fips": false,
    "SecurityPolicyName": "TransferSecurityPolicy-2018-11",
    "SshCiphers": [
      "chacha20-poly1305@openssh.com",
      "aes128-ctr",
      "aes192-ctr",
      "aes256-ctr",
      "aes128-gcm@openssh.com",
      "aes256-gcm@openssh.com"
    ],
    "SshKexs": [
      "curve25519-sha256",
      "curve25519-sha256@libssh.org",
      "ecdh-sha2-nistp256",
      "ecdh-sha2-nistp384",
      "ecdh-sha2-nistp521",
      "diffie-hellman-group-exchange-sha256",
      "diffie-hellman-group16-sha512",
      "diffie-hellman-group18-sha512",
      "diffie-hellman-group14-sha256",
      "diffie-hellman-group14-sha1"
    ],
    "SshMacs": [
      "umac-64-etm@openssh.com",
      "umac-128-etm@openssh.com",
      "hmac-sha2-256-etm@openssh.com",
      "hmac-sha2-512-etm@openssh.com",
      "hmac-sha1-etm@openssh.com",
      "umac-64@openssh.com",
      "umac-128@openssh.com",
      "hmac-sha2-256",
      "hmac-sha2-512",
      "hmac-sha1"
    ],
    "TlsCiphers": [
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
      "TLS_RSA_WITH_AES_128_CBC_SHA256",
      "TLS_RSA_WITH_AES_256_CBC_SHA256"
    ]
  }
}

转让安全性政策

下面显示了转移安全策略 FIPS 2020-06 安全策略。此安全策略包含所有受支持的 FIPS 兼容加密算法。这是启用 FIPS 的服务器端点的默认安全策略。

注意

FIPS 服务终端节点和传输安全策略 FIPS 2020-06 安全策略仅在某些Amazon区域。有关更多信息，请参阅 。Amazon Transfer Family终端节点和配额中的Amazon一般参考. 

{
  "SecurityPolicy": {
    "Fips": true,
    "SecurityPolicyName": "TransferSecurityPolicy-FIPS-2020-06",
    "SshCiphers": [
      "aes128-ctr",
      "aes192-ctr",
      "aes256-ctr",
      "aes128-gcm@openssh.com",
      "aes256-gcm@openssh.com"
    ],
    "SshKexs": [
      "ecdh-sha2-nistp256",
      "ecdh-sha2-nistp384",
      "ecdh-sha2-nistp521",
      "diffie-hellman-group-exchange-sha256",
      "diffie-hellman-group16-sha512",
      "diffie-hellman-group18-sha512",
      "diffie-hellman-group14-sha256"
    ],
    "SshMacs": [
      "hmac-sha2-256-etm@openssh.com",
      "hmac-sha2-512-etm@openssh.com",
      "hmac-sha2-256",
      "hmac-sha2-512"
    ],
    "TlsCiphers": [
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
    ]
  }
}