I have a report detailing weak ssh ciphers on a system. How can I dis-allow these specific weak ciphers. The common solution which I am aware of is adding the following lines in sshd_config (which is a white list approach):

Ciphers aes128-ctr,aes192-ctr,aes256-ctr
MACs hmac-sha1,hmac-ripemd160

The solution I am looking for is a config which in theory allows all ciphers and MACs except the weak ones (blacklist approach) as opposed to explicitly define which ciphers are allowed only.

  • You've stated it backwards: a 'black' list is the ones that are prohibited, a 'white' list is the ones that are permitted. Commented May 26, 2017 at 4:47
  • you are very right, I tweaked the wording Commented May 29, 2017 at 5:52

1 Answer 1


It depends on what OpenSSH version are you using. In versions below 7.5, you have no other option than you already said -- list all the white-listed algorithms.

Since OpenSSH 7.5 you can use - modifier, which will blacklist "bad" algorithms from the default set, such as

Ciphers -arcfour
MACs -hmac-md5

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .