crypto-policies disable key exchange
How do you disable specific key exchange algorithms for SSH using an update-crypto-policy module?
Specifically, based upon server audit results I'm trying to disable the diffie-hellman-group-exchange-sha1 kex for SSH.
I've tried creating /etc/crypto-policies/policies/modules/NO-DHE.pmod
with content like:
key_exchange@SSH = -ECDHE
but seems to make no difference in /etc/crypto-policies/state/CURRENT.pol regards of what different kex I put in like "-ECDHE" above in my example.
Bonus question: How do you know which of the key exchange abbreviations like above for diffie hellman algorithms contains diffie-hellman-group-exchange-sha1?
Yes, I know I can I can configure sshd_config to not use update-crypto-policies but I'd much rather RH monitor and maintain this security information and we receive updates via the standard package channels.
Thank you!