Skip to content

Instantly share code, notes, and snippets.

@latuminggi

latuminggi/Disable weak SSH ciphers in Linux

Last active April 16, 2025 13:37
Show Gist options
  • Save latuminggi/491b4433ca3c787633321f83c37d6d3d to your computer and use it in GitHub Desktop.
Save latuminggi/491b4433ca3c787633321f83c37d6d3d to your computer and use it in GitHub Desktop.
Download ZIP
Disable weak SSH ciphers in Linux
Raw
Disable weak SSH ciphers in Linux
### Disable weak SSH ciphers in Linux ###
# check ssh ciphers, macs, and kexalgorithms
sshd -T | grep "\(ciphers\|macs\|kexalgorithms\)"
# edit sshd_config
nano /etc/ssh/sshd_config
# add following conf lines into most bottom of sshd_config file
Ciphers [email protected],[email protected],aes256-ctr,aes128-ctr
MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-sha1
KexAlgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
# or use these following lines
Ciphers aes256-ctr,aes128-ctr
MACs hmac-sha2-512,hmac-sha2-256,hmac-sha1
KexAlgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
# restart ssh
service ssh restart
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment