Still, wondering how to disable weak SSH ciphers in Linux? We can help you.

Here at Bobcares, we provide support to SSH related queries as part of our Server Management Services for web hosts and online service providers.

Today we’ll take a look at how to disable the weak ciphers

Explore more about SSH Ciphers in Linux

To connect to remote computers, SSH is a standard protocol. Evidently, OpenSSH also has become a popular essential tool on Linux, BSD’s, OS X, and Windows.

However, older OpenSSH installations may not support strong ciphers or protocols. As a result, new OpenSSH installations often enable relatively weak ciphers/protocols ensuring backward-compatibility with older clients.

Cipher is a set of procedures for performing encryption or decryption of data with SSH protocol.

The data transfer is dependable on Cipher set. By default, most server administrators always disable weak algorithms and only allow stronger ones. As a result, this leads to a mismatch in SSL ciphers in various servers.

How to know the algorithms used by SSH service to disable weak SSH ciphers

Before disabling the weaker algorithms, we need to first know the algorithms that are being used. Let us take a look at how our Support Engineers do this.

Initially, we execute the following command within the system that we want to verify:

# sshd -T | grep “\(ciphers\|macs\|kexalgorithms\)”

For example, the above command can show output as given below:

gssapikexalgorithms gss-gex-sha1-,gss-group1-sha1-,gss-group14-sha1-
ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc
macs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
kexalgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

All the algorithms supported by the SSH service can be seen.

If there is no explicit list of ciphers set in ssh_config using the Ciphers keyword, then the default value for ssh_config and sshd_config is:

aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc, arcfour

ssh -Q cipher from the client will tell which schemes the client can support.

Note that this list is not affected by the list of ciphers specified in ssh_config. Removing a cipher from ssh_config will not remove it from the output of ssh -Q cipher.

How to disable weak SSH ciphers in Linux

Let’s now take a deep look into how our Engineers the weak algorithms. This can be done either at the server side or at the client-side.

Disable weak algorithms at server side

1. First, we log into the server as a root user.

2. Then, we open the file sshd_config located in /etc/ssh and add the following directives.

Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,hmac-sha1
KexAlgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

We just make sure to add only the secure SSH ciphers.

3. At last, to make the changes effective in SSH, we restart sshd service

service sshd restart

Once this is done, the SSH service will stop accepting weak cipher and MAC algorithms and this will improve the security of this service. Then we can check the allowed ciphers, macs, and key algorithms again.

Disable weak algorithms at client side

1. Initially, we log into the server as a root user.

2. Then, we open the file ssh_config located in /etc/ssh and add the following directives.

Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,hmac-sha1
KexAlgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

We just make sure to add only the secure SSH ciphers.

3. At last, to make the changes effective in SSH, we restart sshd service

service sshd restart

[Need any further assistance with SSH queries? – We’re available 24*7]

Conclusion

In short, How to disable weak SSH ciphers in Linux has quite an easy solution. It is by adding a directive in the config file and can be either at the server-side or client-side.