# How to Disable Weak SSH Ciphers

> URL: https://www.atlantic.net/dedicated-server-hosting/how-to-disable-weak-ssh-ciphers/ | Published: 2024-08-29 | Updated: 2024-09-09 | Author: Hitesh Jethva

SSH (Secure Shell) is the backbone of secure remote connections to your servers. But did you know that using weak SSH ciphers can put your entire system at risk? Weak ciphers can be exploited by attackers, leaving your data exposed.

In this guide, we’ll explore how to disable weak SSH ciphers and ensure your connections are as secure as possible.

## Understanding SSH Ciphers

SSH ciphers are encryption algorithms that secure your SSH connections. They protect your data as it travels between your computer and the server. There are different types of SSH ciphers, including symmetric, asymmetric, and MACs (Message Authentication Codes).

**Symmetric ciphers** use the same key to encrypt and decrypt data. Examples include AES (Advanced Encryption Standard) and 3DES.

**Asymmetric ciphers** use a pair of keys: one to encrypt and another to decrypt. RSA (Rivest–Shamir–Adleman) is a common example.

## Identifying Weak SSH Ciphers in Your System

Before disabling weak ciphers, you need to identify them. Here’s how to do it:

1. List all available ciphers on your server with this command:

```bash
ssh -Q cipher
```

Output:

```bash
3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
aes128-ctr
aes192-ctr
aes256-ctr
aes128-gcm@openssh.com
aes256-gcm@openssh.com
chacha20-poly1305@openssh.com
```

The list above shows both strong and weak ciphers. Your job is to identify and disable the weak ones.

2. Check the currently enabled ciphers in your SSH configuration file:

```bash
nano /etc/ssh/sshd_config
```

Look for the line starting with Ciphers. If it’s not there, you’ll need to add it later.

3. Identify weak ciphers from the list. Common weak ciphers include:

```bash
3des-cbc
aes128-cbc
aes192-cbc
```

These ciphers are less secure and should be disabled.

## Disabling Weak SSH Ciphers

Now that you know which ciphers to disable, let’s edit the SSH configuration file.

1. Open the SSH configuration file:

```bash
nano /etc/ssh/sshd_config
```

2. Add or update the Ciphers line to include only strong ciphers:

```bash
Ciphers aes256-ctr,aes192-ctr,aes128-ctr
```

This line ensures that only the strong ciphers are used. You’re telling SSH to ignore the weak ones.

3. Save and exit the file by pressing Ctrl + X, then Y, and Enter.

4. Restart the SSH service to apply the changes:

```bash
systemctl restart sshd
```

## Testing the Configuration

After adding the new ciphers, you should test the configuration to make sure everything works correctly.

1. Try to connect to your server using SSH:

```bash
ssh -vvv user@your-server-ip
```

The -vvv option enables verbose mode, which shows detailed information about the connection, including which ciphers are being used.

Check the ciphers in use in the output. You should see something like this:

```bash
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: aes256-ctr,aes192-ctr,aes128-ctr
debug2: ciphers stoc: aes256-ctr,aes192-ctr,aes128-ctr
```

The above output confirms that your server only uses strong ciphers.

2. Troubleshoot if necessary. If the SSH service fails to restart or if you can’t connect, check the **sshd_config** file for typos or errors.

## Conclusion

Securing your SSH connections by disabling weak ciphers is essential for protecting your server. By following this guide, you’ve taken a significant step toward enhancing your system’s security. Remember to regularly review your settings and stay up-to-date with the latest security practices. Try to disable weak ciphers on [**dedicated server hosting**](https://www.atlantic.net/dedicated-server-hosting/) from Atlantic.Net!