We are going through the process of hardening Amazon Linux 1 based on CIS.

Control 5.2.12 states under "Expected Values" :

The following List String value(s) X indicate the current status of the MACs setting defined within the /etc/ssh/sshd_config file.

======Expected Value(s)======
contains regular expression list
[email protected]
[email protected]
[email protected]
hmac-sha2-512 hmac-sha2-256
[email protected]
[email protected]

Based on this RHEL documentation of the setting, we appended the following to /etc/ssh/sshd_config:

MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected],[email protected],diffie-hellman-group-exchange-sha256

/etc/init.d/sshd restart results in the following error:

Starting sshd: /etc/ssh/sshd_config line 142: Bad SSH2 Mac spec '[email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected],[email protected],diffie-hellman-group-exchange-sha256'. [FAILED]

How do we configure SSHD MACs on Amazon Linux?


1 Answer 1


That log entry indicates that your version of OpenSSH didn't recognize one or more of the MAC algorithms you specified.

Given that it's Amazon Linux, I would guess it's going to be anything related to curve25519. Otherwise, you can try adding them one at a time until it fails to start again, then you will know which is the cause.

  • Thank you, this worked. By progressively testing, I found that [email protected] and diffie-hellman-group-exchange-sha256 had to be removed. The Amazon Linux version is 4.14.47-56.37.amzn1.x86_64
    – Lightbeard
    Jul 26, 2018 at 13:13
  • 1
    That's pretty unfortunate. I suggest moving to Amazon Linux 2 if you can. Or another more reasonable Linux distro. Jul 26, 2018 at 13:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .