SSH (Secure Shell) is the backbone of secure remote connections to your servers. But did you know that using weak SSH ciphers can put your entire system at risk? Weak ciphers can be exploited by attackers, leaving your data exposed.

In this guide, we’ll explore how to disable weak SSH ciphers and ensure your connections are as secure as possible.

Understanding SSH Ciphers

SSH ciphers are encryption algorithms that secure your SSH connections. They protect your data as it travels between your computer and the server. There are different types of SSH ciphers, including symmetric, asymmetric, and MACs (Message Authentication Codes).

Symmetric ciphers use the same key to encrypt and decrypt data. Examples include AES (Advanced Encryption Standard) and 3DES.

Asymmetric ciphers use a pair of keys: one to encrypt and another to decrypt. RSA (Rivest–Shamir–Adleman) is a common example.

Identifying Weak SSH Ciphers in Your System

Before disabling weak ciphers, you need to identify them. Here’s how to do it:

1. List all available ciphers on your server with this command:

ssh -Q cipher

Output:

3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
aes128-ctr
aes192-ctr
aes256-ctr
[email protected]
[email protected]
[email protected]

The list above shows both strong and weak ciphers. Your job is to identify and disable the weak ones.

2. Check the currently enabled ciphers in your SSH configuration file:

nano /etc/ssh/sshd_config

Look for the line starting with Ciphers. If it’s not there, you’ll need to add it later.

3. Identify weak ciphers from the list. Common weak ciphers include:

3des-cbc
aes128-cbc
aes192-cbc

These ciphers are less secure and should be disabled.

Disabling Weak SSH Ciphers

Now that you know which ciphers to disable, let’s edit the SSH configuration file.

1. Open the SSH configuration file:

nano /etc/ssh/sshd_config

2. Add or update the Ciphers line to include only strong ciphers:

Ciphers aes256-ctr,aes192-ctr,aes128-ctr

This line ensures that only the strong ciphers are used. You’re telling SSH to ignore the weak ones.

3. Save and exit the file by pressing Ctrl + X, then Y, and Enter.

4. Restart the SSH service to apply the changes:

systemctl restart sshd

Testing the Configuration

After adding the new ciphers, you should test the configuration to make sure everything works correctly.

1. Try to connect to your server using SSH:

ssh -vvv user@your-server-ip

The -vvv option enables verbose mode, which shows detailed information about the connection, including which ciphers are being used.

Check the ciphers in use in the output. You should see something like this:

debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: aes256-ctr,aes192-ctr,aes128-ctr
debug2: ciphers stoc: aes256-ctr,aes192-ctr,aes128-ctr

The above output confirms that your server only uses strong ciphers.

2. Troubleshoot if necessary. If the SSH service fails to restart or if you can’t connect, check the sshd_config file for typos or errors.

Conclusion

Securing your SSH connections by disabling weak ciphers is essential for protecting your server. By following this guide, you’ve taken a significant step toward enhancing your system’s security. Remember to regularly review your settings and stay up-to-date with the latest security practices. Try to disable weak ciphers on dedicated server hosting from Atlantic.Net!