Select Your Language

Infrastructure and Management

Cloud Computing

Storage

Runtimes

Integration and Automation

  • Comments
  • crypto-policies disable key exchange

    Posted on

    How do you disable specific key exchange algorithms for SSH using an update-crypto-policy module?

    Specifically, based upon server audit results I'm trying to disable the diffie-hellman-group-exchange-sha1 kex for SSH.

    I've tried creating /etc/crypto-policies/policies/modules/NO-DHE.pmod
    with content like:

    key_exchange@SSH = -ECDHE
    

    but seems to make no difference in /etc/crypto-policies/state/CURRENT.pol regards of what different kex I put in like "-ECDHE" above in my example.

    Bonus question: How do you know which of the key exchange abbreviations like above for diffie hellman algorithms contains diffie-hellman-group-exchange-sha1?

    Yes, I know I can I can configure sshd_config to not use update-crypto-policies but I'd much rather RH monitor and maintain this security information and we receive updates via the standard package channels.

    Thank you!

    by

    points

    Responses

    Red Hat LinkedIn YouTube Facebook X, formerly Twitter

    Quick Links

    Help

    Site Info

    Related Sites

    © 2026 Red Hat