Disable ssh weak ciphers for CheckPoint Smart-1 410

[May_Kyaw]

Hello,

I would like to know that can I disable support for weak ciphers (Arcfour and Cipher Block Chaining (CBC) cipher suites) and want to implement  support of strong ciphers (Counter (CTR)). 

Can I know the steps.?

[HeikoAnkenbrand · Accepted solution]

Starting from R80.40 you can change that by editing sshd_config content by changing the default SSH encryption method used. To change the default SSH encryption method used, do the following and edit the chiper in the /etc/ssh/templates/sshd_config.templ file.

For example, to set the default encryption method:

Ciphers aes256-ctr,aes128-ctr,...

Restart the SSH server using the "service sshd restart" command.

Version R81.10+ introduces these commands to change the configuration with Clish:

• set ssh server cipher VALUE off
• set ssh server cipher VALUE on
• set ssh server mac VALUE off
• set ssh server mac VALUE on
• show ssh server cipher enabled
• show ssh server cipher supported
• show ssh server mac enabled
• show ssh server mac supported

[HeikoAnkenbrand]

More see here:
sk106031 - How to change SSH encryption protocols and Message Authentication Code settings
sk179517 - How to change mac/cipher/kex algorithms in R81.10+ 

[PhoneBoy]

From R80.40 JHF 83 through R81, the correct approach is to edit /etc/ssh/templates/sshd_config.templ instead of /etc/ssh/sshd_config 

[HeikoAnkenbrand]

THX @PhoneBoy,

I forgot the red area in the path/file:
/etc/ssh/templates/sshd_config.templ

I have changed it above.

[May_Kyaw]

Thanks so much. I will try this.