Oracle Linux 7: How To Disable SSH Server Weak Key Exchange Algorithm diffie-hellman-group1-sha1 (Doc ID 2803881.1)

Last updated on MAY 29, 2024

Applies to:

Goal

The diffie-hellman-group1-sha1 key exchange algorithm is considered a weaker algorithm.
At time of writing, the IETF define the algorithm as one that SHOULD NOT be used rather than one that MUST NOT be used:

• https://datatracker.ietf.org/doc/draft-ietf-curdle-ssh-kex-sha2/

OpenSSH on Oracle Linux 7 (OL7) currently supports and enables the algorithm that security/vulnerability scanners such as Qualys may detect as vulnerable.
To ensure maximum security, one should consider disabling weaker OpenSSH key exchange algorithms.
This document describes how to disable the diffie-hellman-group1-sha1 key exchange algorithm on Oracle Linux 7.
The same process may also be used to disable other weaker or non-required algorithms.

Solution

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.