17

I have found that my server via SSH still supports diffie-hellman-group1-sha1. To stay compliant with latest PCI Compliance I have been trying to figure out how to disable diffie-hellman-group1-sha1. Weakdh.org doesn't exactly give clear instructions on how to disable this nor anything on the web. What is the proper way to disable this algorithm without disabling Port 22 for SSH on Ubuntu? Below is what algorithms my server supports when running ssh -Q kex.

diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
diffie-hellman-group1-sha1
[email protected]
1

4 Answers 4

13

running ssh -Q kex

gives you the list of client supported algorithms. The server ones you will get from sshd -T | grep kex (on the server of course).

And if you want to remove one, just take the list you get from previous command, remove the algorithm you are interested in and put it in the /etc/ssh/sshd_config (or replace existing line there with the kex algorithms).

14

In OpenSSH 7.6 if you want to remove one or more options and leave the remaining defaults you can add the following line to /etc/ssh/sshd_config:

KexAlgorithms -diffie-hellman-group1-sha1,ecdh-sha2-nistp256

Note the - at the start of the comma separated list. The above line would disable diffie-hellman-group1-sha1 and ecdh-sha2-nistp256.

This is detailed further in man sshd_config under KexAlgorithms:

If the specified value begins with a ‘-’ character, then the specified methods (including
wildcards) will be removed from the default set instead of replacing them.

One final note, after making any changes to /etc/ssh/sshd_config always verify them using sshd -t before restarting sshd.

1
  • 4
    FYSA, I know this ticket says Ubuntu but for anyone else, CentOS 7 uses OpenSSH 7.4 so the - option isn't supported. Dec 6, 2021 at 22:38
10

man sshd_config

 KexAlgorithms
         Specifies the available KEX (Key Exchange) algorithms.  Multiple algorithms must be comma-separated.  The default is

               [email protected],
               ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
               diffie-hellman-group-exchange-sha256,
               diffie-hellman-group-exchange-sha1,
               diffie-hellman-group14-sha1,
               diffie-hellman-group1-sha1

So to disable "diffie-hellman-group1-sha1" , specify required Algorithms with Parameter KexAlgorithms

Example

KexAlgorithms diffie-hellman-group-exchange-sha256,[email protected],

2

For the RedHat 8 / CentOS 8 systems use below steps to disable insecure key exchange algorithm diffie-hellman-group-exchange-sha1

Step 1: To list out openssh client supported Key Exchange Algorithms algorithms

# ssh -Q kex

Step 2: To list out openssh server supported Key Exchange Algorithms algorithms

# sshd -T | grep kex

Step 3: Remove diffie-hellman-group-exchange-sha1 SSH Weak Key Exchange Algorithms.

# vi /etc/ssh/sshd_config

Step 4: Take the backup of the below listed openssh server & client configuration files.

# cp -p /etc/crypto-policies/back-ends/openssh.config /etc/crypto-policies/back-ends/openssh.config-bkp

# cp -p /etc/crypto-policies/back-ends/opensshserver.config /etc/crypto-policies/back-ends/opensshserver.config-bkp

Step 5: Now remove diffie-hellman-group-exchange-sha1 Weak Key Exchange Algorithms from both openssh server & client configuration files.

# vi /etc/crypto-policies/back-ends/openssh.config 
# vi /etc/crypto-policies/back-ends/opensshserver.config

Step 5: Verify diffie-hellman-group-exchange-sha1 Exchange Algorithms entry removed properly or not.

# grep -i diffie-hellman-group-exchange-sha1 /etc/crypto-policies/back-ends/openssh.config

# grep -i diffie-hellman-group-exchange-sha1 /etc/crypto-policies/back-ends/opensshserver.config

There should not be any output for above listed commands.

Step 6: Restart the sshd.service

# systemctl restart sshd.service
# systemctl status sshd.service

Step 7: Now you can establish the SSH connection with verbose mode and there should not be any debug kex names logs for diffie-hellman-group-exchange-sha1

# ssh -vvv username@IP-Address
# ssh -o KexAlgorithms=diffie-hellman-group-exchange-sha1 [email protected]
# nmap --script ssh2-enum-algos -sV -p 22 127.0.0.1

For the RedHat 7 systems use below command to disable Insecure key exchange algorithms in use

  • diffie-hellman-group-exchange-sha1
  • diffie-hellman-group1-sha1

Execute below commands one after another.

# cp -p /etc/ssh/ssh_config /etc/ssh/ssh_config-bkp 

# for kex in `ssh -Q kex| grep -vE "diffie-hellman-group-exchange-sha1|diffie-hellman-group1-sha1"|paste -s -d,`; do echo "KexAlgorithms $kex"; done >> /etc/ssh/ssh_config

# sudo systemctl restart sshd; systemctl status sshd

# ssh -vvv username@IP-Address
# ssh -o KexAlgorithms=diffie-hellman-group-exchange-sha1 [email protected]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .