# Unable to remove cipher suites from ssh **URL:** \ **Category:** Rocky Linux Help & Support\ **Created:** [January 28, 2022, 3:20pm UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226 "2022-01-28T15:20:30Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![jamesw](https://avatars.discourse-cdn.com/v4/letter/j/ad7895/32.png) [@jamesw](https://forums.rockylinux.org/u/jamesw)\ **Post date:** [January 28, 2022, 3:20pm UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/1 "2022-01-28T15:20:30Z")
Hello, This is not Rocky8 related but I hope someone here can land a helping hand as I am at a loss. I asked google and searched openssh forum (inactive since 2013) and did find anything useful. The ssh from OpenSSH on Rocky 8 supports less secure ciphers such as aes128-cbc. Output of ‘ssh -Q cipher’: 3des-cbc aes128-cbc … I want to remove all the cbc weak ciphers . However, I cannot seem to do it. I put cipher line in ssh\_config and backend config files. But ‘ssh -Q cipher’ still shows all the -cbc ciphers. ssh seems to have these ciphers compiled in: strings ssh | grep ‘-cbc’ aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc Our university security scan shows the server ssh supports weak ciphers and I was asked to remove the weak ciphers. Does anyone know a way to remove weak ciphers from ssh or tell ssh to not support them? Thank you. James Wang ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [January 28, 2022, 5:04pm UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/2 "2022-01-28T17:04:10Z")
> [@jamesw](#): > > But ‘ssh -Q cipher’ still shows all the -cbc ciphers. The `ssh` is a client. Surely it shows what it does support, not what some `sshd` in some server supports? The _security scan_ must negotiate with the sshd in your machine. What if you try to connect to your machine, but force your client to use a cbc cipher? Connection should fail if you have successfully removed support. ---
**Author:** ![jamesw](https://avatars.discourse-cdn.com/v4/letter/j/ad7895/32.png) [@jamesw](https://forums.rockylinux.org/u/jamesw)\ **Post date:** [January 28, 2022, 5:32pm UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/3 "2022-01-28T17:32:14Z")
Hi Jlehtone, Thanks for your reply. Our security team required us to have an account on our servers they use to do ‘credential scans’. The scanner reports back saying ssh allows weak ciphers, hex, and macs. The sshd on the servers is fine after I removed weak ciphers,hex,macs in sshd\_config. But putting same lines in ssh\_config or .ssh/config makes no difference on ssh client. Very weird. Best, James ---
**Author:** ![sweh](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/sweh/32/1287_2.png) [@sweh](https://forums.rockylinux.org/u/sweh)\ **Post date:** [January 28, 2022, 6:28pm UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/4 "2022-01-28T18:28:07Z")
`ssh -Q cipher` reports on the list of _available_ ciphers, not the ones that have been configured for use. I don’t think the `ssh` command even parses the `ssh_config` or `~/.ssh/config` files with the `-Q` option. You can demonstrate that by adding a line `badline` to this file and seeing that `ssh localhost` errors out but `ssh -Q cipher` does not. ---
**Author:** ![gerry666uk](https://avatars.discourse-cdn.com/v4/letter/g/dbc845/32.png) [@gerry666uk](https://forums.rockylinux.org/u/gerry666uk)\ **Post date:** [January 28, 2022, 6:55pm UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/5 "2022-01-28T18:55:59Z")
RHEL8 (Rocky 8.5) now has the concept of “system wide crypto policies”. `man crypto-policies` The idea is to have system wide defaults, as opposed to per application variance. ---
**Author:** ![jamesw](https://avatars.discourse-cdn.com/v4/letter/j/ad7895/32.png) [@jamesw](https://forums.rockylinux.org/u/jamesw)\ **Post date:** [January 28, 2022, 6:56pm UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/6 "2022-01-28T18:56:50Z")
Thank you sweh! That is it. Followed your suggestion, I can see the ‘ssh -Q cipher’ doesn’t read the ssh\_config. On our server when I did ‘ssh -vv localhost’, I saw (ctos and stoc): debug2: ciphers ctos: [chacha20-poly1305@openssh.com](mailto:chacha20-poly1305@openssh.com),aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr debug2: ciphers stoc: [chacha20-poly1305@openssh.com](mailto:chacha20-poly1305@openssh.com),aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr That’s what I wanted and I now know what to tell to our security team. Thanks, James ---
**Author:** ![jamesw](https://avatars.discourse-cdn.com/v4/letter/j/ad7895/32.png) [@jamesw](https://forums.rockylinux.org/u/jamesw)\ **Post date:** [January 28, 2022, 7:33pm UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/7 "2022-01-28T19:33:19Z")
Thank you Gerry for the information. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [January 28, 2022, 8:05pm UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/8 "2022-01-28T20:05:50Z")
> [@gerry666uk](#): > > crypto-policies RHEL doc about them has a section about openssh: [https://access.redhat.com/documentation/en-us/red\_hat\_enterprise\_linux/8/html/security\_hardening/using-the-system-wide-cryptographic-policies\_security-hardening#examples-of-opting-out-of-system-wide-crypto-policies\_using-the-system-wide-cryptographic-policies](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening#examples-of-opting-out-of-system-wide-crypto-policies_using-the-system-wide-cryptographic-policies) ---
**Author:** ![anemarkus](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@anemarkus](https://forums.rockylinux.org/u/anemarkus)\ **Post date:** [January 28, 2022, 10:44pm UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/9 "2022-01-28T22:44:13Z")
> [@gerry666uk](#): > > crypto policies And here is a article about changing a crypto policy > **[Configuring RHEL 8 for compliance with crypto-policy related to Cipher Block...](https://www.redhat.com/en/blog/configuring-rhel-8-compliance-crypto-policy-related-cipher-block-chaining)** > > In this post, we’ll walk through an example of how to configure Red Hat Enterprise Linux (RHEL) 8 crypto-policy to remove Cipher block chaining (CBC), but let’s start with a little background on CBC and default crypto-policy on RHEL 8. ---
**Author:** ![jamesw](https://avatars.discourse-cdn.com/v4/letter/j/ad7895/32.png) [@jamesw](https://forums.rockylinux.org/u/jamesw)\ **Post date:** [January 31, 2022, 2:27pm UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/10 "2022-01-31T14:27:41Z")
Hi anemarkus Thanks for the article! It is a great read. I am so glad that I asked here. I am going to modify our Rocky8 servers based on our university policies. James ---
**Author:** ![warron.french](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/warron.french/32/869_2.png) [@warron.french](https://forums.rockylinux.org/u/warron.french)\ **Post date:** [February 4, 2022, 12:43am UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/11 "2022-02-04T00:43:46Z")
@jamesw , consider the fact the host providing the SSH service requires changes to the KEX, MACs, and Ciphers found in the **/etc/ssh/sshd\_config** file. Also, if you are reviewing Tenable scans that are providing you feedback about your Compliance results; consider the fact many things the scanner is looking for is expected to literally be in the same order. I use the word literally accurately in this case, because where many people use the word literally too liberally, and they actually mean metaphorically. Be aware, that if you have RHEL 6 variants that need access to this server, you need to ensure you have **hmac-sha1** listed in association with your **MACs** setting. ---
**Author:** ![jamesw](https://avatars.discourse-cdn.com/v4/letter/j/ad7895/32.png) [@jamesw](https://forums.rockylinux.org/u/jamesw)\ **Post date:** [February 4, 2022, 1:44pm UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/12 "2022-02-04T13:44:05Z")
Thank you Warron. I will keep it in mind. We do have a few CentOS 6 or older servers and I am in process of upgrading them to Rocky8. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [February 4, 2022, 2:30pm UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/13 "2022-02-04T14:30:26Z")
> [@warron.french](#): > > consider the fact the host providing the SSH service requires changes to the KEX, MACs, and Ciphers found in the **/etc/ssh/sshd\_config** file. The systemd unit-file for `sshd.service` contains: ```auto EnvironmentFile=-/etc/crypto-policies/back-ends/opensshserver.config EnvironmentFile=-/etc/sysconfig/sshd ExecStart=/usr/sbin/sshd -D $OPTIONS $CRYPTO_POLICY ``` The `man sshd` writes: “command-line options override values specified in the configuration file.” The `/etc/crypto-policies/back-ends/opensshserver.config` is provided by package **crypto-policies** and defines `CRYPTO_POLICY`. Therefore, your current _crypto policy_ overrides all Ciphers that you set in _/etc/ssh/sshd\_config_. ---
**Author:** ![warron.french](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/warron.french/32/869_2.png) [@warron.french](https://forums.rockylinux.org/u/warron.french)\ **Post date:** [February 6, 2022, 3:39am UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/14 "2022-02-06T03:39:39Z")
This is also true @jlehtone , but most people know about the configurations listed directly and explicitly in the **/etc/ssh/sshd\_config** file and when the ssh packages are updated it doesn’t matter which file has your updates there will be an _rpmsave_ file created. As such, you will realize the package was updated and you **may need** to copy back your configurations (_most of the time not_); so leaving your custom changes in a file that is regularly checked makes it easier for troubleshooting than putting the custom changes into a file that is rarely reviewed if at all. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [February 6, 2022, 10:35am UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/15 "2022-02-06T10:35:58Z")
Yes, but the point was – if we are talking about the ‘Ciphers’ option – that the Ciphers you set in _/etc/ssh/sshd\_config_ are completely ignored. Yes, you might get rpmnew/rpmsave when ‘openssh-server’ is updated, but the actual changes to Ciphers are in different package, file, and directory. Furthermore, for ciphers in ssh client, the `/etc/ssh/ssh_config` ends with: ```auto # This system is following system-wide crypto policy. # To modify the system-wide ssh configuration, create a *.conf file under # /etc/ssh/ssh_config.d/ which will be automatically included below Include /etc/ssh/ssh_config.d/*.conf ``` The idea is that customizations are added as separate files, so there will be less/no rpmnew/rpmsave. On one hand customizations remain clearly separate from defaults. On the other hand it is less obvious when customizations have to be adapted. EL8 has `/etc/ssh/ssh_config.d/`. EL9 will have `/etc/ssh/sshd_config.d/` too. ---
**Author:** ![brian](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/brian/32/5777_2.png) [@brian](https://forums.rockylinux.org/u/brian)\ **Post date:** [August 25, 2023, 3:55am UTC](https://forums.rockylinux.org/t/unable-to-remove-cipher-suites-from-ssh/5226/16 "2023-08-25T03:55:50Z")
Closed on August 25, 2023, 3:55am UTC