3

I have read and understand the posting from here, https://security.stackexchange.com/questions/39756/secure-configuration-of-ciphers-macs-kex-available-in-ssh. However, I would like to know what the /etc/sshd_config configuration would look like should I want to accomplish the following goals:

  • Disable any 96-bit HMAC Algorithms
  • Disable any MD5-based HMAC Algorithms

Would it be the following?

MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1-etm@openssh.com,hmac-sha1,umac-128-etm@openssh.com,umac-64-etm@openssh.com,umac-128@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-ripemd160

Note that this question is looking for the configuration setting(s) needed; and not reasons, rationale, or discussion of why this may or may not be a good idea.

Improve this question

1 Answer 1

Reset to default
3

The man page says so. Why don't you just try it out ? Setup a SSH server somewhere, with that configuration, and connect to it from another machine with ssh -vv: the debug log will show the list of MAC algorithms advertised as supported by the server.

(I read your last sentence as: "I know this is stupid but I don't want to discuss it", which I further interpret as "I am looking for the fastest way to shut some dumb auditors up".)

Improve this answer
3
  • 3
    yes, this is due to some audits being performed where the network based vulnerability scanner is showing vulnerabilities for "SSH Insecure HMAC Algorithms Enabled." I am looking for a configuration that will satisfy their scans.
    – John
    Oct 7, 2013 at 16:08
  • Sounds like nessus. I was just playing around with this, thanks for that!
    – pdu
    Nov 27, 2014 at 8:51
  • man pages are most useful to those who already know how it works (it being whatever the man page is about)... so the "RTFM" portion of the answer isn't terribly helpful.
    – Smithers
    Jan 19, 2015 at 23:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.