6

I'm new to this but have been searching everywhere for a clear answer.

To pass PCI compliance the Arcfour cipher should be disabled.

I've tried to edit the ciphers in my sshd_conf and ssh_conf files to no avail.

As far as I can make out the default ciphers are

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc

I've tired removing the arcfour instances from that line and also adding a '-' (minus) before them which didn't work either.

How does one disable arcfour ciphers?

We're running CentOS 6.8 in case that helps.

3
  • is it possible that the scanner is finding a separate SSL service that's using arcfour (https)?
    – Jeff Schaller ♦
    Nov 8, 2016 at 17:38
  • This is the scan command they are using nmap -Pn -sV --script ssh2-enum-algos 87.xxx.xxx.160 -p22 which I'm assuming is scanning port 22. Would I edit those settings elsewhere?
    – Steviehype
    Nov 8, 2016 at 17:52
  • you can check what ciphers sshd will allow with; $ sshd -T 2>/dev/null | grep -i cipher
    – mikejonesey
    Nov 8, 2016 at 23:23

3 Answers 3

Reset to default
7

CentOS 5, 6 & 7 don't have a Ciphers line in the /etc/ssh/sshd_config file so you get the full default list of ciphers. So to exclude arcfour add the following lines to your sshd_config file:

# restrict ciphers to exclude arcfour
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc

Then restart sshd:

service sshd restart

As noted above you can test using

ssh <hostname> -c arcfour

If the specified cipher is disabled you'll get a response like

no matching cipher found: client arcfour server aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc

otherwise you'll see the normal login process.

2
  • The OP already said that he has edited sshd_config, which in case does have Ciphers line without any reference to arcfour. But then again it looks like the problem is that sshd doesn't seem to obey his config changes. Nice try, but you realise you ended up replicating what was already posted?
    – zagrimsan
    Mar 29, 2017 at 10:01
  • Sure - not claiming originality. See this more as confirmation that the advice really should work and summarizing in a recipe.
    – bosmith
    Mar 29, 2017 at 12:42
1

On Centos, RHEL, Oracle Linux 5, 6, and 7, just execute the following as root from a bash shell:

echo "Ciphers $(ssh -Q cipher | grep -v arcfour | while read r; do echo -n "$r," ; done)" >>/etc/ssh/sshd_config && /sbin/service sshd restart
1
  • ssh -Q works only in version 7 os the said OS.
    – David Ramirez
    Dec 11, 2020 at 22:58
0

Step 1

Remove the ciphers "arcfour128", "arcfour256" and "arcfour" from your sshd config.

Step 2

Restart sshd: service sshd restart

Related read: https://wiki.centos.org/HowTos/Network/SecuringSSH

5
  • Thanks for your reply @jan. I've got this line in my sshd_conf Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc i.e. arcfour removed, I've restarted sshd and NMAP is still reporting that those encryptions are still active. What am I doing wrong?
    – Steviehype
    Nov 8, 2016 at 17:18
  • 2
    Then either nmap is wrong or your sshd uses another config file. Are you 100% sure you edited the SERVER config file (/etc/ssh/sshd_config) and not the global client config? Did you restart?
    – Jan
    Nov 8, 2016 at 17:20
  • I'm 100% sure I've edited /etc/ssh/sshd_config. Trustwave are using NMAP as evidence that Arcfour ciphers are supported so, ideally I need to get this to work. Thanks again for your thoughts.
    – Steviehype
    Nov 8, 2016 at 17:25
  • 1
    Log on to the machine in question and check yourself: ssh localhost -c arcfour. You should get no matching cipher found: client arcfour server whatever-ciphers-are-enabled-on-the-server
    – Jan
    Nov 8, 2016 at 17:28
  • I'm sorry, I'm not sure I follow. I'm logged on. If I type ssh localhost -c arcfour it asks me for the password, which I enter and it just takes me back to where I was [root@s1xxxxx90 ~]# with a blinking cursor... If I type only ssh -c arcfour I get a usage list.
    – Steviehype
    Nov 8, 2016 at 17:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .