How to disable weak cipher protocols and keys from ssh on azure devops server

Question

How to disable weak cipher protocols and keys from ssh on azure devops server

Porfyriadis, Nikolaos (ADV D EU CZ AE ED 2) 1

Dear Sir or Madam I wan to ask you how to disable weak cipher protocols and keys from Azure DevOps server. Especially those host key ssh-rsa cipher aes256-cbc cipher aes192-cbc cipher aes128-cbc thank you

2 answers

Your answer

Answer 1

Michael Taylor 60,161

Normally to disable weak ciphers on a Windows server you just run IISCrypto and disable the protocols that you don't want. Reboot the machine and they are no longer available.

You should google for the recommended ones to disable as the landscape changes. Many protocols have been identified as weak so you should disable them. But note that you may have a special case need to leave some enabled if you are talking to a legacy system. That shouldn't be an issue for a DevOps server though.

Answer 2

Porfyriadis, Nikolaos (ADV D EU CZ AE ED 2) 1

Hello thank you for your answer. I tried IIS Crypto already but those protocols are not included in the list. On the other hand they are there if you try with powershell User's image

User's image

Any ideas?

Porfyriadis, Nikolaos (ADV D EU CZ AE ED 2) 1 Reputation point

2024-02-01T16:04:24.3333333+00:00

The problem derives from an Azure DevOps server. no openssh or other ssh application is installed!
Michael Taylor 60,161 Reputation points

2024-02-01T16:23:26.5866667+00:00

You're under the Cipher Suites section. Go to SChannel and you'll see the list of Ciphers. Remove the one's you don't want. But, again, you should look at the current list of recommended ciphers and only disable the one's that aren't secure.

Share via

How to disable weak cipher protocols and keys from ssh on azure devops server

2 answers

Your answer