ssh-audit and Disabling Legacy SSH Algorithms

A hardened sshd that still offers ssh-rsa, diffie-hellman-group14-sha1, and aes128-cbc is only half hardened. Scanners do not care that you disabled passwords if they can drag the handshake down to a 2000s primitive. ssh-audit is a small Python tool that speaks the SSH protocol, lists what your daemon offers, and grades it. The work after the scan is a drop-in that pins KexAlgorithms, Ciphers, MACs, HostKeyAlgorithms, and PubkeyAcceptedAlgorithms to a modern set.

This is not fail2ban and it is not 2FA. It is the algorithm list. L3/L4 DDoS filtering on a public VPS will not save a SHA-1 handshake.

Scan first, do not guess the offer list

Install ssh-audit from pipx or your distro. Point it at the VPS. Read warnings before you start deleting algorithms; Ubuntu 24.04 is already closer to modern than Ubuntu 18.04, but stock configs still tolerate leftovers for compatibility.

pipx install ssh-audit
ssh-audit 203.0.113.10
ssh-audit -P 22 203.0.113.10

The tool reports kex, host key, cipher, MAC, and whether compression or an old auth method is in play. Green is current. Yellow is compatible but dated. Red is do-not-offer. Anything with SHA-1 in the name, CBC mode, arcfour, 3des, or diffie-hellman-group1-sha1 goes. ssh-rsa as a host-key algorithm is SHA-1 signatures; rsa-sha2-256 and rsa-sha2-512 are the RSA that remains acceptable if you still have an RSA host key. Prefer ed25519 host keys and stop generating RSA host keys on new boxes.

Run the client-side audit too if you care what your laptop will accept. A locked-down server is wasted if a corporate jump box only speaks group14-sha1. Fix the jump box; do not reopen SHA-1 on the farm.

Pin algorithms in a drop-in

Put the allowlist in sshd_config.d so a package upgrade does not silently merge old defaults back into a hand-edited main file. After the drop-in, sshd -t, then a reload, then ssh-audit again.

sudo tee /etc/ssh/sshd_config.d/80-algorithms.conf > /dev/null <<'EOF'
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
PubkeyAcceptedAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
HostKey /etc/ssh/ssh_host_ed25519_key
EOF
sudo sshd -t
sudo ssh-keygen -A
sudo systemctl reload ssh
ssh-audit 203.0.113.10

Drop sntrup761x25519-sha512@openssh.com if sshd -t rejects it; older OpenSSH used a slightly different hybrid name, and some builds omit the post-quantum kex entirely. ssh -Q kex, ssh -Q cipher, ssh -Q mac, and ssh -Q HostKeyAlgorithms print what this binary actually implements. Never paste an algorithm the binary does not know; sshd will fail to start.

On Intel Xeon Platinum, AES-NI makes aes256-gcm the fast path. chacha20-poly1305 is constant-time without AES-NI and is a fine default first cipher; OpenSSH will pick GCM when both sides prefer it. Do not enable umac or hmac-sha1 "for old Android". Give the old device a Match User legacy block if you must, with a comment and a removal date.

Host keys, client config, and known_hosts

Generate a missing ed25519 host key with ssh-keygen -A. Remove HostKey lines that point at ssh_host_rsa_key if you are ready to drop RSA, or keep rsa-sha2-* until every client has seen the ed25519 key. Changing host keys without host certificates produces TOFU warnings; warn operators before you do it.

On the client, a matching ~/.ssh/config Host * stanza with the same algorithm lists stops the client from offering weak kex even if a random server asks. That is defense in depth for when you SSH somewhere that is not yours.

Re-run ssh-audit after every image rebuild. Cloud-init can restore a stock sshd_config.d. Put your drop-in in the image or in the first Ansible play, not in a wiki.

Compatibility without rolling back the farm

The one leftover that still shows up is an appliance that can only do diffie-hellman-group14-sha256 and aes128-ctr. Put that in a Match User appliance Address x.x.x.x, not in the global list. Do not reopen CBC to make a vendor happy. If the vendor cannot move, isolate that account on a dedicated listener.

Compression is a separate discussion. Compression delayed is the modern default. Turning compression on for a slow link is fine; it is not an algorithm-grade issue.

A short takeaway: scan with ssh-audit, pin a modern offer list, verify with ssh -Q and a second session, and keep exceptions in Match. Algorithm hygiene is independent of fail2ban and independent of L3/L4 filtering. Apply the drop-in on a Netbay Ubuntu 24.04 VPS — High-Speed SSD, Xeon Platinum, up in under 60 seconds at netbayhosts.in.