Disable SSH Weak Key Exchange Algorithms and SSH Server CBC Mode Ciphers

1. Add the bellow setup on /etc/ssh/sshd_config

# Disable SSH Weak Key Exchange Algorithms
KexAlgorithms curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1

2. Also file /etc/sysconfig/sshd should be changed. The line

CRYPTO_POLICY=

3. restart service sshd

systemctl restart sshd

4. Verification setup with command :

# nmap -p 22 -Pn --script ssh2-enum-algos --script-args ssh2-enum-algos.mode=weak-macs localhost
Starting Nmap 7.92 ( https://nmap.org ) at 2024-08-06 16:50 WIB
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000098s latency).
Other addresses for localhost (not scanned): ::1

PORT STATE SERVICE
22/tcp open ssh
| ssh2-enum-algos:
| kex_algorithms: (11)
| curve25519-sha256
| [email protected]
| ecdh-sha2-nistp256
| ecdh-sha2-nistp384
| ecdh-sha2-nistp521
| diffie-hellman-group-exchange-sha256
| diffie-hellman-group16-sha512
| diffie-hellman-group18-sha512
| diffie-hellman-group14-sha256
| diffie-hellman-group14-sha1
| [email protected]
| server_host_key_algorithms: (5)
| rsa-sha2-512
| rsa-sha2-256
| ssh-rsa
| ecdsa-sha2-nistp256
| ssh-ed25519
| encryption_algorithms: (6)
| [email protected]
| aes128-ctr
| aes192-ctr
| aes256-ctr
| [email protected]
| [email protected]
| mac_algorithms: (10)
| [email protected]
| [email protected]
| [email protected]
| [email protected]
| [email protected]
| [email protected]
| [email protected]
| hmac-sha2-256
| hmac-sha2-512
| hmac-sha1
| compression_algorithms: (2)
| none
|_ [email protected]

Nmap done: 1 IP address (1 host up) scanned in 0.40 seconds