Check Details

• Resource: Server
• Check: Ensure only strong SSH ciphers are used
• Risk: Weak SSH ciphers can allow attackers to decrypt sensitive data or exploit vulnerabilities in encryption algorithms.

Remediation Steps

1. Open a terminal session on the server with root or sudo privileges.

2. Verify the currently configured SSH ciphers using the following command:

   

   sshd -T | grep ciphers
   

3. Review the output and ensure that it does not include weak ciphers such as:

   3des-cbc, aes*-cbc, arcfour, blowfish-cbc, cast128-cbc

4. Edit the SSH configuration file:

   

   sudo nano /etc/ssh/sshd_config
   

5. Add or modify the Ciphers line to include only strong ciphers:

   

   Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
   

6. Save the file and exit the editor.

7. Restart the SSH service to apply changes:

   

   sudo systemctl restart sshd
   

8. Re-run the audit command to verify that only strong ciphers are configured.
9. Perform regular audits to ensure weak ciphers are not reintroduced.