Other Articles

Servers – Verify SSH Strong Key Exchange Algorithms

Support > Fixing Checks > Server

06 March, 2026

This check ensures that only strong SSH Key Exchange (KEX) algorithms are configured on the server.

Weak key exchange algorithms can expose SSH sessions to man-in-the-middle attacks and cryptographic weaknesses. Configuring strong KEX algorithms ensures secure and trusted key negotiation during SSH connections.

Check Details

  • Resource: Server
  • Check: Ensure only strong SSH Key Exchange algorithms are used
  • Risk: Weak KEX algorithms may allow attackers to intercept or manipulate SSH sessions.

Remediation Steps

  1. Open a terminal session with root or sudo privileges.

  2. Verify currently configured KEX algorithms:

    sshd -T | grep -i kexalgorithms

  3. Ensure output does not include weak algorithms such as:

    diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, diffie-hellman-group-exchange-sha1

  4. Edit SSH configuration file:

    sudo nano /etc/ssh/sshd_config

  5. Add or modify the KexAlgorithms line with strong algorithms:

    KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
  6. Save the file and exit.

  7. Restart SSH service:

    sudo systemctl restart sshd
  8. Re-run the audit command to confirm only strong algorithms are configured.
  9. Perform regular audits to ensure weak KEX algorithms are not reintroduced.