topic Re: Disable ssh weak ciphers for CheckPoint Smart-1 410 in Firewall and Security Management

Disable ssh weak ciphers for CheckPoint Smart-1 410

May_Kyaw — Wed, 01 Feb 2023 15:21:31 GMT

Hello,

I would like to know that can I disable support for weak ciphers (Arcfour and Cipher Block Chaining (CBC) cipher suites) and want to implement support of strong ciphers (Counter (CTR)).

Can I know the steps.?

Re: Disable ssh weak ciphers for CheckPoint Smart-1 410

HeikoAnkenbrand — Wed, 01 Feb 2023 22:46:48 GMT

Starting from R80.40 you can change that by editing sshd_config content by changing the default SSH encryption method used. To change the default SSH encryption method used, do the following and edit the chiper in the /etc/ssh/templates/sshd_config.templ file.

For example, to set the default encryption method:

Ciphers aes256-ctr,aes128-ctr,...

Restart the SSH server using the "service sshd restart" command.

Version R81.10+ introduces these commands to change the configuration with Clish:

set ssh server cipher VALUE off
set ssh server cipher VALUE on
set ssh server mac VALUE off
set ssh server mac VALUE on
show ssh server cipher enabled
show ssh server cipher supported
show ssh server mac enabled
show ssh server mac supported

Re: Disable ssh weak ciphers for CheckPoint Smart-1 410

HeikoAnkenbrand — Wed, 01 Feb 2023 17:39:46 GMT

More see here:
sk106031 - How to change SSH encryption protocols and Message Authentication Code settings
sk179517 - How to change mac/cipher/kex algorithms in R81.10+

Re: Disable ssh weak ciphers for CheckPoint Smart-1 410

PhoneBoy — Wed, 01 Feb 2023 17:50:07 GMT

From R80.40 JHF 83 through R81, the correct approach is to edit /etc/ssh/templates/sshd_config.templ instead of /etc/ssh/sshd_config

Re: Disable ssh weak ciphers for CheckPoint Smart-1 410

HeikoAnkenbrand — Wed, 01 Feb 2023 22:45:41 GMT

THX @PhoneBoy,

I forgot the red area in the path/file:
/etc/ssh/templates/sshd_config.templ

I have changed it above.

Re: Disable ssh weak ciphers for CheckPoint Smart-1 410

May_Kyaw — Thu, 02 Feb 2023 02:14:04 GMT

Thanks so much. I will try this.