Other Articles

Servers – Verify SSH Strong MAC Algorithms

Support > Fixing Checks > Server

06 March, 2026

This check ensures that only strong SSH MAC (Message Authentication Code) algorithms are configured on the server.

Weak MAC algorithms can expose SSH sessions to integrity attacks such as message tampering and downgrade attacks. Configuring strong MACs ensures secure and tamper-proof SSH communication.

Check Details

  • Resource: Server
  • Check: Ensure only strong SSH MAC algorithms are used
  • Risk: Weak MAC algorithms can allow attackers to tamper with SSH sessions or exploit downgrade attacks.

Remediation Steps

  1. Open a terminal session with root or sudo privileges.

  2. Verify currently configured MAC algorithms:

    sshd -T | grep -i macs

  3. Ensure output does not include weak MAC algorithms such as:

    hmac-md5, hmac-md5-96, hmac-ripemd160, hmac-sha1, hmac-sha1-96, umac-64@openssh.com

  4. Edit SSH configuration file:

    sudo nano /etc/ssh/sshd_config

  5. Add or modify the MACs line with strong algorithms:

    MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
  6. Save the file and exit.

  7. Restart SSH service:

    sudo systemctl restart sshd
  8. Re-run the audit command to confirm only strong MACs are configured.
  9. Perform regular audits to ensure weak MACs are not reintroduced.