Synopsis

The remote service offers an insecure cryptographic protocol.

Description

The remote SSH daemon supports connections made using the version 1.33 and/or 1.5 of the SSH protocol.

These protocols are not completely cryptographically safe so they should not be used.

Follow the steps given below to disable SSH protocol version 1 session key retrieval on a HP-UX server.

Default list of ciphers which contains weak ciphers are arcfour arcfour128 arcfour256 aes128-cbc 3des-cbc blowfish-cbc cast128-cbc aes192-cbc aes256-cbc
As you can see that by default SSH protocol version 1 and 2 both are enabled on HP-UX servers.
```
# cat /opt/ssh/etc/sshd_config

.
.
Protocol 2,1
.
.
```
To disable the SSH protocol version 1 on a HP-UX server edit the /opt/ssh/etc/sshd_config file and keep the protocol value only 2 as shown below.
```
# vi /opt/ssh/etc/sshd_config

.
.
Protocol 2
.
.
```

Save the file and restart the ssh service using the below command.

# /sbin/init.d/secsh stop
HP-UX Secure Shell stopped
# /sbin/init.d/secsh start
HP-UX Secure Shell started

After disabling SSH protocol version 1 if you try ssh using protocol version 1, you will get below message:
```
# ssh -1 <server>
Protocol major versions differ: 1 vs. 2
```
Now, above message confirm that SSH protocol version 1 session key retrieval has been disabled on your HP-UX system.

Last Updated: July 11, 2021