up vote 3 down vote favorite
1

I have read and understand the posting from here, https://security.stackexchange.com/questions/39756/secure-configuration-of-ciphers-macs-kex-available-in-ssh. However, I would like to know what the /etc/sshd_config configuration would look like should I want to accomplish the following goals:

  • Disable any 96-bit HMAC Algorithms
  • Disable any MD5-based HMAC Algorithms

Would it be the following?

MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1-etm@openssh.com,hmac-sha1,umac-128-etm@openssh.com,umac-64-etm@openssh.com,umac-128@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-ripemd160

Note that this question is looking for the configuration setting(s) needed; and not reasons, rationale, or discussion of why this may or may not be a good idea.

share|improve this question

migrated from security.stackexchange.com Oct 7 '13 at 23:43

This question came from our site for information security professionals.

up vote 3 down vote

The man page says so. Why don't you just try it out ? Setup a SSH server somewhere, with that configuration, and connect to it from another machine with ssh -vv: the debug log will show the list of MAC algorithms advertised as supported by the server.

(I read your last sentence as: "I know this is stupid but I don't want to discuss it", which I further interpret as "I am looking for the fastest way to shut some dumb auditors up".)

share|improve this answer
  • 3
    yes, this is due to some audits being performed where the network based vulnerability scanner is showing vulnerabilities for "SSH Insecure HMAC Algorithms Enabled." I am looking for a configuration that will satisfy their scans. – John Oct 7 '13 at 16:08
  • Sounds like nessus. I was just playing around with this, thanks for that! – pduersteler Nov 27 '14 at 8:51
  • man pages are most useful to those who already know how it works (it being whatever the man page is about)... so the "RTFM" portion of the answer isn't terribly helpful. – Smithers Jan 19 '15 at 23:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.