5.2 Reconfiguring Secure Shell Ciphers

Perform the following steps to reconfigure SSH to remove the weak ciphers:

  1. In /etc/ssh/sshd_config (server) and /etc/ssh/ssh_config (client), search for Ciphers. The following is the default configuration:

    # Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc

  2. Uncomment this line and replace it with the following value:

    Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc

  3. Restart SSH by running the service sshd restart command.