Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
May_Kyaw
Explorer
Jump to solution

Disable ssh weak ciphers for CheckPoint Smart-1 410

Hello,

  

I would like to know that can I disable support for weak ciphers (Arcfour and Cipher Block Chaining (CBC) cipher suites) and want to implement  support of strong ciphers (Counter (CTR)). 

Can I know the steps.?

0 Kudos
1 Solution

Accepted Solutions
HeikoAnkenbrand
Champion Champion
Champion

Starting from R80.40 you can change that by editing sshd_config content by changing the default SSH encryption method used. To change the default SSH encryption method used, do the following and edit the chiper in the /etc/ssh/templates/sshd_config.templ file.

For example, to set the default encryption method:

Ciphers aes256-ctr,aes128-ctr,...

Restart the SSH server using the "service sshd restart" command.

Version R81.10+ introduces these commands to change the configuration with Clish:

  • set ssh server cipher VALUE off
  • set ssh server cipher VALUE on
  • set ssh server mac VALUE off
  • set ssh server mac VALUE on
  • show ssh server cipher enabled
  • show ssh server cipher supported
  • show ssh server mac enabled
  • show ssh server mac supported
➜ CCSM Elite, CCME, CCTE

View solution in original post

5 Replies
HeikoAnkenbrand
Champion Champion
Champion

Starting from R80.40 you can change that by editing sshd_config content by changing the default SSH encryption method used. To change the default SSH encryption method used, do the following and edit the chiper in the /etc/ssh/templates/sshd_config.templ file.

For example, to set the default encryption method:

Ciphers aes256-ctr,aes128-ctr,...

Restart the SSH server using the "service sshd restart" command.

Version R81.10+ introduces these commands to change the configuration with Clish:

  • set ssh server cipher VALUE off
  • set ssh server cipher VALUE on
  • set ssh server mac VALUE off
  • set ssh server mac VALUE on
  • show ssh server cipher enabled
  • show ssh server cipher supported
  • show ssh server mac enabled
  • show ssh server mac supported
➜ CCSM Elite, CCME, CCTE
PhoneBoy
Admin
Admin

From R80.40 JHF 83 through R81, the correct approach is to edit /etc/ssh/templates/sshd_config.templ instead of /etc/ssh/sshd_config 

HeikoAnkenbrand
Champion Champion
Champion

THX @PhoneBoy,

I forgot the red area in the path/file:
/etc/ssh/templates/sshd_config.templ

I have changed it above.

➜ CCSM Elite, CCME, CCTE
0 Kudos
May_Kyaw
Explorer

Thanks so much. I will try this.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events