Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

algorithm recommendations for OpenSSH 6.7 #28

Open
takenek opened this issue Jun 28, 2017 · 3 comments
Open

algorithm recommendations for OpenSSH 6.7 #28

takenek opened this issue Jun 28, 2017 · 3 comments

Comments

@takenek
Copy link

takenek commented Jun 28, 2017

Hello
I scan my Debian 8 with OpenSSH version: SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u3
I get recomendation:

algorithm recommendations (for OpenSSH 6.7)

(rec) -ecdsa-sha2-nistp256 -- key algorithm to remove
(rec) -ssh-dss -- key algorithm to remove

But how to remove this algoritm?
I can`t use:
HostKeyAlgorithms ssh-rsa,rsa-sha2-512,rsa-sha2-256
because HostKeyAlgorithms support only for version OpenSSH 7.0+

Best Regards
TaKeN
@scolby33
Copy link

I had success by commenting out the HostKey /etc/ssh/ssh_host_ecdsa directive. I didn't have the issue with ssh-dss, but there might be a HostKey for that as well.

@graysky2
Copy link

graysky2 commented Oct 6, 2017 •
edited
Loading

@takenek - I'm no expert but I am using the following in /etc/ssh/sshd_config on another distro:

KexAlgorithms [email protected],diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group18-sha512
MACs [email protected],[email protected],[email protected]
#Ciphers
HostKeyAlgorithms ssh-rsa,rsa-sha2-256,rsa-sha2-512

@takenek
Copy link
Author

takenek commented Oct 11, 2017 •
edited
Loading

@graysky2 This is for OpenSSH 6.7?
I just put Your config and got it:

Oct 11 09:40:10 zabbix sshd[41017]: /etc/ssh/sshd_config line 89: Bad SSH2 KexAlgorithms '[email protected],diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group18-sha512'.
And the most important "HostKeyAlgorithms" is not support in OpenSSH <7.0 so You can`t use this in old Linux distro.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@graysky2 @takenek @scolby33