Insecure MAC algorithms in use: hmac-sha1-etm@openssh.com,hmac-sha1

Rocky Linux Help & Support
1

I need help. How do I format the pmod file to disable hmac-sha1-etm@openssh.com and hmac-sha1 together using the update-crypto-policies --set name.pmod. I can get the hmac-sha1 to stick but the other I get Bad value of policy property `mac’ when trying to combine them together in one file. Any suggestions or advice would be appreciate. Thank you Carlos

2 
# sshd -T | grep mac
macs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
# touch /etc/crypto-policies/policies/modules/TEST.pmod
# echo "mac = -HMAC-SHA1" > /etc/crypto-policies/policies/modules/TEST.pmod
# update-crypto-policies --show
LEGACY
# update-crypto-policies --set LEGACY:TEST
# sshd -T | grep mac
macs hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,umac-128@openssh.com,hmac-sha2-512

Is that what you are looking for?

3

Yes thank you. I found out there was another way to do it.

update-crypto-policies --set DEFAULT:NO-SHA1

Thank you for the help. Carlos