Centos7/SSH Weak Key Exchange Algorithms Enabled/SSH Server CBC Mode Ciphers Enabled

SSH Weak Key Exchange Algorithms Enabled

SSH Server CBC Mode Ciphers Enabled

https://knowledge.broadcom.com/external/article/263231/disabling-weak-kex-algorithms-hostkey-al.html
http://kb.ictbanking.net/article.php?id=690&oid=2
https://access.redhat.com/solutions/6963758

----------------------
# sshd -T | grep "$ciphers\|macs\|kexalgorithms$"
gssapikexalgorithms gss-gex-sha1-,gss-group1-sha1-,gss-group14-sha1-
ciphers chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256                           -gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
macs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-et                           m@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-                           sha2-512,hmac-sha1
kexalgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,e                           cdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-                           group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group                           14-sha1,diffie-hellman-group1-sha1

-----------------------
# vi /etc/ssh/sshd_config
Ciphers aes128-ctr,aes192-ctr,aes256-ctr
KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256
MACs hmac-sha2-256,hmac-sha2-512
gssapikeyexchange no
gssapiauthentication no

-----------------------

# systemctl restart sshd
----------------------

# sshd -T | grep "$ciphers\|macs\|kexalgorithms$"
gssapikexalgorithms gss-gex-sha1-,gss-group1-sha1-,gss-group14-sha1-
ciphers aes128-ctr,aes192-ctr,aes256-ctr
macs hmac-sha2-256,hmac-sha2-512
kexalgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256
------------------------------------------------------
#sshd -T | grep gssapi