# Hmac-md5-96 bit need to be disable **URL:** \ **Category:** Rocky Linux Help & Support\ **Created:** [February 6, 2024, 4:18am UTC](https://forums.rockylinux.org/t/hmac-md5-96-bit-need-to-be-disable/12768 "2024-02-06T04:18:38Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![rakesh](https://avatars.discourse-cdn.com/v4/letter/r/258eb7/32.png) [@rakesh](https://forums.rockylinux.org/u/rakesh)\ **Post date:** [February 6, 2024, 4:18am UTC](https://forums.rockylinux.org/t/hmac-md5-96-bit-need-to-be-disable/12768/1 "2024-02-06T04:18:38Z")
We have done the VULNERABILITIES scanning and it’s says to disable the hmac-md5-96 bit need to be disable but in our ssh configuration file we have added the entry to disable to hmac-md5-96. Ciphers [chacha20-poly1305@openssh.com](mailto:chacha20-poly1305@openssh.com),aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com #MACs [hmac-md5,umac-64@openssh.com](mailto:hmac-md5,umac-64@openssh.com),hmac-sha1-96,hmac-md5-96,hmac-sha2-256,hmac-sha2-512 MACs [hmac-sha2-256,hmac-sha2-512,umac-128@openssh.com](mailto:hmac-sha2-256,hmac-sha2-512,umac-128@openssh.com),hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-96,hmac-md5-96 But still the VULNERABILITIES is not get closing can u help me on this. ---
**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\ **Post date:** [February 7, 2024, 2:16am UTC](https://forums.rockylinux.org/t/hmac-md5-96-bit-need-to-be-disable/12768/2 "2024-02-07T02:16:55Z")
Changing ciphers in the sshd\_config file will not get you very far, as it is dictated by the crypto-policy on the system. I recommend reading the following articles: > **[Chapter 3. Using system-wide cryptographic policies Red Hat...](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening)** > > Access Red Hat’s knowledge, guidance, and support through your subscription. > **[Chapter 3. Using system-wide cryptographic policies Red Hat...](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening)** > > Access Red Hat’s knowledge, guidance, and support through your subscription. ---
**Author:** ![rakesh](https://avatars.discourse-cdn.com/v4/letter/r/258eb7/32.png) [@rakesh](https://forums.rockylinux.org/u/rakesh)\ **Post date:** [February 8, 2024, 3:34pm UTC](https://forums.rockylinux.org/t/hmac-md5-96-bit-need-to-be-disable/12768/3 "2024-02-08T15:34:57Z")
@label , I have changed cryptographic from Legacy to Default but after that when we do the VULNERABILITIES scanning now it’s giving below error. **Insecure MAC algorithms in use: [hmac-sha1-etm@openssh.com](mailto:hmac-sha1-etm@openssh.com),hmac-sha1** Where we have removed the those lines in the sshd config file as well in /etc/crypto-policies/back-ends/openssh.config file Can you people pls help me on this issue ---
**Author:** ![rakesh](https://avatars.discourse-cdn.com/v4/letter/r/258eb7/32.png) [@rakesh](https://forums.rockylinux.org/u/rakesh)\ **Post date:** [February 9, 2024, 4:19am UTC](https://forums.rockylinux.org/t/hmac-md5-96-bit-need-to-be-disable/12768/4 "2024-02-09T04:19:30Z")
Issue fixed, thanks @label for your support. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [April 9, 2024, 4:20am UTC](https://forums.rockylinux.org/t/hmac-md5-96-bit-need-to-be-disable/12768/5 "2024-04-09T04:20:30Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.