Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have read and understand the posting from here, Secure Configuration of Ciphers/MACs/Kex available in SSH. However, I would like to know what the /etc/sshd_config configuration would look like should I want to accomplish the following goals:

  • Disable any 96-bit HMAC Algorithms
  • Disable any MD5-based HMAC Algorithms

Would it be the following?

MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1-etm@openssh.com,hmac-sha1,umac-128-etm@openssh.com,umac-64-etm@openssh.com,umac-128@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-ripemd160

Note that this question is looking for the configuration setting(s) needed; and not reasons, rationale, or discussion of why this may or may not be a good idea.

share|improve this question

migrated from security.stackexchange.com Oct 7 '13 at 23:43

This question came from our site for Information security professionals.

1 Answer 1

The man page says so. Why don't you just try it out ? Setup a SSH server somewhere, with that configuration, and connect to it from another machine with ssh -vv: the debug log will show the list of MAC algorithms advertised as supported by the server.

(I read your last sentence as: "I know this is stupid but I don't want to discuss it", which I further interpret as "I am looking for the fastest way to shut some dumb auditors up".)

share|improve this answer
2  
yes, this is due to some audits being performed where the network based vulnerability scanner is showing vulnerabilities for "SSH Insecure HMAC Algorithms Enabled." I am looking for a configuration that will satisfy their scans. –  John Oct 7 '13 at 16:08
    
Sounds like nessus. I was just playing around with this, thanks for that! –  pduersteler 9 hours ago

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.