This article will demonstrate how to disable weak HMAC algorithms in your Linux OS. This article will assume Ubuntu as the underlying Linux Operating System, but the general principal can be applied to Redhat as well.
For demonstration purposes, let us assume a vulnerability scan has informed you that a remote ssh server is configured to allow or support weak MAC algorithms. The recommend mitigation is to disable to reported weak MAC algorithms. In this example, the algorithms are as follows:
- umac-64-etm@openssh.com
- umac-64@openssh.com
The most straightforward way to disable these MACs is to edit the sshd_config on your server.
- Open the sshd_config file
sudo vi /etc/ssh/sshd_config- Add the following line to the bottom of the file
MACs -*-64*- Restart the sshd service
sudo service sshd restart- Verify both the umac-64-etm@openssh.com and umac-64@openssh.com MACs are disabled.
sudo sshd -T | egrep '^macs'Conclusion – Disable Weak HMAC Algorithms
There you have it. The two HMAC algorithms in question have been disabled using the differential specification method. You can obviously be specific in which HMAC is disabled without using wildcards. If you have any questions or would like to see more examples please leave us a comment. If this article has been helpful to you, read more of our content.
Leave a Reply