topic Re: How to edit/modify weak ciphers for SSH server in General Topics

How to edit/modify weak ciphers for SSH server

Gaurav_Pandya — Mon, 26 Jan 2026 16:32:22 GMT

Below are the steps to disable weak ciphers on an SSH server. This configuration is frequently flagged during vulnerability scans.

R81.10+ version

Log in to the command line on the Gaia OS.
Enter Clish mode.
View the currently enabled KEX algorithms using the command:
"show ssh server kex enabled"
Disable the weak algorithm:
"set ssh server kex diffie-hellman-group1-sha1 off"
Save the configuration permanently:
"save config"

R81 and lower versions

1. Connect to the command line on Gaia OS.
2. Log in to the Expert mode.
3. Back up the current /etc/ssh/sshd_config file:
cd /etc/ssh
cp sshd_config sshd_config_BCK1

4. Edit the current /etc/ssh/sshd_config file:

vi /etc/ssh/sshd_config

5. Set the required Key Exchange method as the value of the "KexAlgorithms" parameter.

Find:
KexAlgorithms +diffie-hellman-group1-sha1
KexAlgorithms +diffie-hellman-group-exchange-sha1

Replace with:

#KexAlgorithms +diffie-hellman-group1-sha1
#KexAlgorithms +diffie-hellman-group-exchange-sha1
KexAlgorithms +diffie-hellman-group16-sha512
KexAlgorithms +diffie-hellman-group14-sha256

6. Save the changes in the file and exit Vi editor.

7. Restart the SSH service:

service sshd restart

Re: How to edit/modify weak ciphers for SSH server

the_rock — Tue, 27 Jan 2026 00:15:31 GMT

Excellent stuff, thanks for that @Gaurav_Pandya

Re: How to edit/modify weak ciphers for SSH server

the_rock — Sun, 01 Feb 2026 16:52:35 GMT

Just tried this in R82 lab, worked great.

Re: How to edit/modify weak ciphers for SSH server

Bob_Zimmerman — Tue, 03 Feb 2026 15:41:03 GMT

Note that on versions which don't have the 'set ssh server' options in clish, the /etc/ssh/sshd_config is overwritten by certain changes in clish. This may undo changes you make to it. To work around this, you can make the changes in /etc/ssh/templates/sshd_config.templ, though that may be overwritten when installing a jumbo.