crypto-policies disable key exchange

Latest response

How do you disable specific key exchange algorithms for SSH using an update-crypto-policy module?

Specifically, based upon server audit results I'm trying to disable the diffie-hellman-group-exchange-sha1 kex for SSH.

I've tried creating /etc/crypto-policies/policies/modules/NO-DHE.pmod
with content like:

key_exchange@SSH = -ECDHE

but seems to make no difference in /etc/crypto-policies/state/CURRENT.pol regards of what different kex I put in like "-ECDHE" above in my example.

Bonus question: How do you know which of the key exchange abbreviations like above for diffie hellman algorithms contains diffie-hellman-group-exchange-sha1?

Yes, I know I can I can configure sshd_config to not use update-crypto-policies but I'd much rather RH monitor and maintain this security information and we receive updates via the standard package channels.

Thank you!

Responses