Vulnerability on our SMS

[gemechisd]

We have scanned our SMS Server and found 2 vulnerablities. Can anyone suggest me how to fix them? 

1. Weak Key Exchange (KEX) Algorithm(s) Supported (SSH)

The remote SSH server is configured to allow / support weak key exchange (KEX) algorithm(s).
Port 22/tcp

2. Weak Encryption Algorithm(s) Supported (SSH)

The remote SSH server is configured to allow / support weak encryption algorithm(s).
Port 22/tcp

[Chris_Atkinson · Accepted solution]

See the resources posted in reply to this discussion amongst others:

https://community.checkpoint.com/t5/Management/How-to-disable-weak-ssh-cipher-on-R80-40-R81-10/td-p/...

[JozkoMrkvicka]

Which KEX and MAC were identified as weak by the scanner?

[gemechisd]

@JozkoMrkvicka 

For KEX

- Disable the reported weak KEX algorithm(s)
     1024-bit MODP group / prime KEX algorithms:
     Alternatively use elliptic-curve Diffie-Hellmann in general, e.g. Curve 25519.

2. For MAC
     Disable the reported weak encryption algorithm(s).

[the_rock]

I would say what @Chris_Atkinson gave is your solution. Btw, you can also run cipher_util from expert mode and see options available there.

Best,

Andy