Solved: Re: Disable diffie-hellman-group14-sha1

Dayaana · ‎2025-03-03

Hello everyone! We encountered a strange situation. We wanted to disable the diffie-hellman-group14-sha1 cipher. When we checked if it was active using the command # sshd -T -C 'user=<username>,addr=::1' | grep kexalgorithms, it was displayed in the output.

We decided to disable it, according to https://support.checkpoint.com/results/sk/sk172189. We have version 81.10 and according to the instructions, we started editing the file /etc/ssh/templates/sshd_config.templ.

However, we found that this configuration file does not have the diffie-hellman-group14-sha1 cipher in the list of ciphers. We added it to the file manually and put the "-" symbol so that the appearance matches the instructions from the article.

However, after this, diffie-hellman-group14-sha1 was still present in the output of # sshd -T -C 'user=<username>,addr=::1' | grep kexalgorithms.

Does anyone know why this cipher was not in the configuration file, but was shown in the output of # sshd -T -C? How can we properly disable this cipher?

There are no blades enabled on the gateway except fw.

I would be grateful for any help!

Dayaana · ‎2025-03-04

The problem was solved by explicitly specifying only the required algorithms in the configuration file.
That is, instead of
-diffie-...
it was necessary to write, for example,
KexAlgorithms diffie-hellman-group14-sha256,diffie-hellman-group16-sha512

View solution in original post

the_rock · ‎2025-03-03

Apologies, did not go through all this myself, but maybe verify if what its listed below from AI copilot is what was done.

Andy

***********************

To disable thediffie-hellman-group14-sha1Key Exchange (KEX) method for SSH on Check Point Gaia OS, follow the appropriate procedure based on your Gaia OS version.

For R81.20 and Higher

Collect the Gaia OS Backup - in Gaia Portal or Gaia Clish.
Connect to the command line on Gaia OS.
Log in to Gaia Clish mode.
Get the list of the enabled KEX ciphers:
```
show ssh server kex enabled
```

Disable the unwanted KEX cipher:

set ssh server kex diffie-hellman-group14-sha1 off

Save the changes in the Gaia OS database:
```
save config
```
Log in to the Expert mode.
Restart the SSH service:
```
service sshd restart
```

For R81.10

Collect the Gaia OS Backup - in Gaia Portal or Gaia Clish.
Connect to the command line on Gaia OS.
Log in to the Expert mode.
Back up the current/etc/ssh/templates/sshd_config.templfile:
```
cp -v /etc/ssh/templates/sshd_config.templ{,_BKP}
```
Edit the current/etc/ssh/templates/sshd_config.templfile:
```
vi /etc/ssh/templates/sshd_config.templ
```

Change+to-for the KexAlgorithms in question:

KexAlgorithms -diffie-hellman-group14-sha1

Save the changes in the file and exit Vi editor.
Load the updated template into the Gaia OS database:
```
/bin/sshd_template_xlate < /config/active
```
Restart the SSH service:
```
service sshd restart
```

Check if the changes were implemented correctly:

sshd -T -C 'user=<username>,addr=::1' | grep kexalgorithms

Example for the username "admin":

sshd -T -C 'user=admin,addr=::1' | grep kexalgorithms

For R80.40 and R81 Versions

Collect the Gaia OS Backup - in Gaia Portal or Gaia Clish.
Connect to the command line on Gaia OS.
Log in to the Expert mode.
Back up the current/etc/ssh/sshd_configfile:
```
cp -v /etc/ssh/sshd_config{,_BKP}
```
Edit the current/etc/ssh/sshd_configfile:
```
vi /etc/ssh/sshd_config
```
Set the required Key Exchange method as the value of theKexAlgorithmsparameter:
```
KexAlgorithms -diffie-hellman-group14-sha1
```
Save the changes in the file and exit Vi editor.
Restart the SSH service:
```
service sshd restart
```

Please make sure to follow the below mandatory guidelines, to minimize the potential impact of this plan as possible:

The kernel debug is a heavy operation (even if it's "light") and might cause a machine to hang or even crash the machine.
You must perform this operation only during a maintenance window due to the high impact this operation might have.
Be sure to have a console connection available in case the machine hangs.
Validate before and after the operation that the state of the machine is stable (no high CPU, etc).

If you encounter any issues or need further assistance, please refer to the relevant documentation or open a ticket in the Check Point Support Center at support.checkpoint.com.

BE AWARE

Important - To prevent negative impact on your production environment, double-check the provided information in the Administration Guide for the involved product.

Learn more:

Best,
Andy

Dayaana · ‎2025-03-03

Thank you very much for the answer! This is exactly what we did, this text corresponds to the instruction from sk172189, according to which we tried to make changes.

However, what we saw did not look like the instruction. We did not find a line containing diffie-hellman-group14-sha1 in the file /etc/ssh/templates/sshd_config.templ, so we added the line KexAlgorithms -diffie-hellman-group14-sha1 manually.

At the same time, in the output of the command sshd -T -C 'user=<username>,addr=::1' | grep kexalgorithms, this cipher was displayed both before and after the changes.

Do you know the reason why this happens?

genisis__ · ‎2025-03-04

On R82 here's what I did for SSH:
set ssh server cipher 3des-cbc off
set ssh server cipher aes128-cbc off
set ssh server cipher aes128-ctr off
set ssh server cipher aes128-gcm@openssh.com on
set ssh server cipher aes192-cbc off
set ssh server cipher aes192-ctr off
set ssh server cipher aes256-cbc off
set ssh server cipher aes256-ctr off
set ssh server cipher aes256-gcm@openssh.com on
set ssh server cipher chacha20-poly1305@openssh.com off
set ssh server cipher rijndael-cbc@lysator.liu.se off
set ssh server mac hmac-md5-96-etm@openssh.com off
set ssh server mac hmac-md5-etm@openssh.com off
set ssh server mac hmac-sha1 off
set ssh server mac hmac-sha1-96-etm@openssh.com off
set ssh server mac hmac-sha1-etm@openssh.com off
set ssh server mac hmac-sha2-256 on
set ssh server mac hmac-sha2-256-etm@openssh.com on
set ssh server mac hmac-sha2-512 on
set ssh server mac hmac-sha2-512-etm@openssh.com on
set ssh server mac umac-64-etm@openssh.com off
set ssh server mac umac-64@openssh.com off
set ssh server mac umac-128-etm@openssh.com off
set ssh server mac umac-128@openssh.com off
set ssh server kex curve25519-sha256 on
set ssh server kex curve25519-sha256@libssh.org on
set ssh server kex diffie-hellman-group1-sha1 off
set ssh server kex diffie-hellman-group14-sha1 off
set ssh server kex diffie-hellman-group14-sha256 on
set ssh server kex diffie-hellman-group16-sha512 on
set ssh server kex diffie-hellman-group18-sha512 on
set ssh server kex diffie-hellman-group-exchange-sha1 off
set ssh server kex diffie-hellman-group-exchange-sha256 on
set ssh server kex ecdh-sha2-nistp256 on
set ssh server kex ecdh-sha2-nistp384 on
set ssh server kex ecdh-sha2-nistp521 on
set ssh server public-key ecdsa-sha2-nistp256 on
set ssh server public-key ecdsa-sha2-nistp256-cert-v01@openssh.com on
set ssh server public-key ecdsa-sha2-nistp384 on
set ssh server public-key ecdsa-sha2-nistp384-cert-v01@openssh.com on
set ssh server public-key ecdsa-sha2-nistp521 on
set ssh server public-key ecdsa-sha2-nistp521-cert-v01@openssh.com on
set ssh server public-key rsa-sha2-256 on
set ssh server public-key rsa-sha2-256-cert-v01@openssh.com on
set ssh server public-key rsa-sha2-512 on
set ssh server public-key rsa-sha2-512-cert-v01@openssh.com on
set ssh server public-key ssh-dss off
set ssh server public-key ssh-dss-cert-v01@openssh.com off
set ssh server public-key ssh-ed25519 on
set ssh server public-key ssh-ed25519-cert-v01@openssh.com on
set ssh server public-key ssh-rsa on
set ssh server public-key ssh-rsa-cert-v01@openssh.com on

The result reported is:
> show ssh server cipher enabled
--------------------------------
enabled cipher:
--------------------------------
aes128-gcm@openssh.com
aes256-gcm@openssh.com

> show ssh server kex enabled
--------------------------------
enabled kex:
--------------------------------
curve25519-sha256
curve25519-sha256@libssh.org
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521

> show ssh server mac enabled
--------------------------------
enabled mac:
--------------------------------
hmac-sha2-256
hmac-sha2-256-etm@openssh.com
hmac-sha2-512
hmac-sha2-512-etm@openssh.com

> show ssh server public-key enabled
--------------------------------
enabled public-key:
--------------------------------
ecdsa-sha2-nistp256
ecdsa-sha2-nistp256-cert-v01@openssh.com
ecdsa-sha2-nistp384
ecdsa-sha2-nistp384-cert-v01@openssh.com
ecdsa-sha2-nistp521
ecdsa-sha2-nistp521-cert-v01@openssh.com
rsa-sha2-256
rsa-sha2-256-cert-v01@openssh.com
rsa-sha2-512
rsa-sha2-512-cert-v01@openssh.com
ssh-ed25519
ssh-ed25519-cert-v01@openssh.com
ssh-rsa
ssh-rsa-cert-v01@openssh.com

Not sure if there are any further recommendations to lock down SSH.

Dayaana · ‎2025-03-04

The problem was solved by explicitly specifying only the required algorithms in the configuration file.
That is, instead of
-diffie-...
it was necessary to write, for example,
KexAlgorithms diffie-hellman-group14-sha256,diffie-hellman-group16-sha512

the_rock · ‎2025-03-04

Glad you got it working. I tested below what I sent you yesterday and worked in both R81.20 and R82, no issues.

Andy

For R81.20 and Higher

Collect the Gaia OS Backup - in Gaia Portal or Gaia Clish.
Connect to the command line on Gaia OS.
Log in to Gaia Clish mode.
Get the list of the enabled KEX ciphers:
```
show ssh server kex enabled
```

Disable the unwanted KEX cipher:

set ssh server kex diffie-hellman-group14-sha1 off

Save the changes in the Gaia OS database:
```
save config
```
Log in to the Expert mode.
Restart the SSH service:
```
service sshd restart
```

Best,
Andy

Are you a member of CheckMates?

Disable diffie-hellman-group14-sha1

For R81.20 and Higher

For R81.10

For R80.40 and R81 Versions

For R81.20 and Higher