how to disable weak SSH ciphers and MACs

TL;DR

Edit your sshd_config to set explicit Ciphers and MACs lists that drop legacy algorithms like CBC ciphers, RC4, MD5, and 96-bit MACs. Restart sshd and verify the offered algorithms with a scan. Test your real clients against the change before rolling it everywhere, because very old clients will break.

The query

how to disable weak SSH ciphers and MACs

Use this when

• A scan flagged your SSH servers for weak ciphers, weak MACs, or legacy key exchange
• You are writing an SSH hardening baseline and want a single approved algorithm list
• You support compliance requirements that ban CBC mode ciphers and MD5-based MACs
• You want to confirm what algorithms your fleet actually negotiates after a change

Not for

• Fixing refused connections caused by firewalls, DNS, or keys; those are different problems
• Client-side ssh_config changes; this is the server side only
• Replacing key-based auth or disabling password auth; those are separate hardening steps
• Deciding on port changes or IP allowlists; this is purely the crypto negotiation

Steps

1. Check what your server currently offers. From another machine, run nmap --script ssh2-enum-algos -p 22 YOUR_HOST and note the ciphers, MACs, and key exchange algorithms listed. Expected output: a full list of currently offered algorithms.
2. Pick the allowed lists. A solid modern set: ciphers [recipient email],[recipient email],[recipient email],aes256-ctr,aes192-ctr,aes128-ctr, MACs [recipient email],[recipient email],hmac-sha2-512,hmac-sha2-256, and KexAlgorithms curve25519-sha256,[recipient email],diffie-hellman-group16-sha512. Expected output: three comma-separated lists saved in your baseline doc.
3. Add them to sshdconfig. Put Ciphers, MACs, and KexAlgorithms lines with your lists in /etc/ssh/sshdconfig, one setting per line. Expected output: the three lines present in the config file.
4. Validate and restart. Run sshd -t to check syntax, then restart the sshd service. Keep an existing session open while you test so you are not locked out. Expected output: sshd -t exits clean, service restarts with no errors.
5. Re-scan from the outside. Run the same nmap enum script again and compare. Expected output: only your approved algorithms appear, legacy ones are gone.
6. Test every client class before fleet rollout. Connect from your oldest supported clients and automation tools; if one cannot negotiate, either upgrade it or make a documented exception. Expected output: all supported clients connect cleanly, exceptions documented.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstuCQvS9jh2VISS-n8qh3ug

Resolved from the public thread: https://vectle.com/posts/pstuCQvS9jh2VISS-n8qh3ug

Thread query: how to disable weak SSH ciphers and MACs

TL;DR: Edit your sshd_config to set explicit Ciphers and MACs lists that drop legacy algorithms like CBC ciphers, RC4, MD5, and 96-bit MACs. Restart sshd and verify the offered algorithms with a scan. Test your real clients against the change before rolling it everywhere, because very old clients will break.