SSH Server CBC Mode Ciphers Enabled: How to Disable CBC and Arcfour Ciphers on Linux

SSH Server CBC Mode Ciphers Enabled means your SSH daemon still offers cipher block chaining ciphers such as aes128-cbc or 3des-cbc, and sometimes arcfour. Fix it by setting an explicit Ciphers line that lists only CTR, GCM and ChaCha20 ciphers, validating with sshd -t, restarting sshd and rescanning. On RHEL 8, change crypto-policies instead.

What the scanner is actually detecting

Two Nessus plugins and their counterparts in other scanners often appear together on older OpenSSH builds and appliances, which is why many reports merge them.

All of these are unauthenticated network checks that read the encryption algorithms the server advertises during key exchange. Tenable notes that plugin 70658 checks configuration, not software versions, so upgrading OpenSSH clears it only if the upgrade changes the offered list. An explicit Ciphers line, or a distribution or crypto-policy default that still includes CBC, keeps it open.

How serious is it?

This is a low-severity hardening issue, not an emergency. CVE-2008-5161 describes a plaintext recovery attack against CBC mode in SSH: an attacker in the network path who tampers with packets may recover a small amount of plaintext, and each failed attempt tears down the connection, so the attack is slow and noisy. OpenSSH dropped CBC and arcfour from sshd’s default list in version 6.7.

Arcfour (RC4) has weak keys and the none cipher leaves the session unencrypted, so plugin 90317 is rated higher.

A more recent reason to drop CBC is the Terrapin attack (CVE-2023-48795), which affects chacha20-poly1305@openssh.com and any -cbc cipher combined with an -etm@openssh.com MAC; AES-GCM is not affected. In practice the main impact is compliance: auditors treat it as failed hardening.

How to confirm it on the host

Start with what sshd loads from its configuration files, including every Include (the /usr/etc/ssh paths are SUSE vendor defaults):

sudo sshd -T | grep -i '^ciphers'
sudo grep -rsiE '^s*ciphers' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/ /usr/etc/ssh/sshd_config /usr/etc/ssh/sshd_config.d/

On RHEL 8 and its rebuilds, sshd.service passes the crypto policy’s cipher list as command-line options, which a manual sshd -T never sees: it can show a CBC-free list while the daemon still offers aes256-cbc. Include the policy in the test:

update-crypto-policies --show
sudo sh -c '. /etc/crypto-policies/back-ends/opensshserver.config; . /etc/sysconfig/sshd; /usr/sbin/sshd -T $CRYPTO_POLICY' | grep -i '^ciphers'

Then check what the running daemon offers on the network, which is what the scanner sees:

nmap -p 22 --script ssh2-enum-algos <host>

In the encryption_algorithms section, anything containing -cbc (including rijndael-cbc@lysator.liu.se), plus arcfour, blowfish or none, is what the finding refers to. Repeat for every port sshd listens on.

How to fix it

The target is one explicit cipher list with no CBC, arcfour, blowfish or none entries:

Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

Keep chacha20-poly1305 only if the server has the Terrapin fix (strict key exchange, OpenSSH 9.6 or a distribution backport) and you control the clients, because strict KEX protects only connections where the client is patched too. A patched server advertises kex-strict-s-v00@openssh.com or kex-strict-s in nmap’s kex_algorithms section, and its changelog mentions the CVE:

rpm -q --changelog openssh-server | grep CVE-2023-48795
zgrep CVE-2023-48795 /usr/share/doc/openssh-server/changelog.Debian.gz

Otherwise use the AES-only list:

Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

OpenSSH older than 6.2, such as 5.3p1 on RHEL/CentOS 6, supports neither GCM nor ChaCha20, so use Ciphers aes256-ctr,aes192-ctr,aes128-ctr there.

Debian, Ubuntu, SUSE and other OpenSSH servers (including RHEL/CentOS 7)

SUSE note: on newer SUSE releases such as openSUSE Tumbleweed, Leap 16, SLES 16 and SLE Micro 6, the vendor file is /usr/etc/ssh/sshd_config. If ls -l /etc/ssh/sshd_config /usr/etc/ssh/sshd_config shows only the /usr/etc file, never create /etc/ssh/sshd_config: sshd would ignore the vendor file and lose its Include lines, UsePAM yes and the sftp Subsystem. Use the step 2 drop-in (create /etc/ssh/sshd_config.d if needed), which is read before /usr/etc/ssh/sshd_config.d/40-suse-crypto-policies.conf. For a full main file, first copy the vendor file to /etc/ssh/sshd_config.

1. Check whether the main file includes a drop-in directory: grep -n ‘^Include’ /etc/ssh/sshd_config
2. If it does, create a drop-in with a low number so it is read early:

   echo 'Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr' | sudo tee /etc/ssh/sshd_config.d/10-ciphers.conf

3. If there is no Include line, edit /etc/ssh/sshd_config directly: replace the existing Ciphers line, or add one above the first Match block.
4. sshd uses the first value it reads for each keyword, so remove any Ciphers line read before yours, such as one in a lower-numbered drop-in.
5. Validate, then restart. The service is called ssh on Debian and Ubuntu and sshd on RHEL and SUSE:

   sudo sshd -t && sudo systemctl restart ssh
   sudo sshd -t && sudo systemctl restart sshd

sshd -t prints nothing when the configuration is valid. If it rejects the list, run ssh -Q cipher (OpenSSH 6.3 or later; on older builds check sshd_config(5)) and remove names your build lacks.

RHEL 8, Rocky Linux 8 and AlmaLinux 8: use crypto-policies

On RHEL 8 the crypto policy supplies sshd’s algorithm lists, and Red Hat documents that Ciphers in sshd_config is only honoured after sshd is opted out of the policy. DEFAULT still permits AES-CBC for SSH, so the supported fix is a policy module:

update-crypto-policies --show
echo 'cipher@SSH = -*-CBC' | sudo tee /etc/crypto-policies/policies/modules/NO-SSH-CBC.pmod
sudo update-crypto-policies --set DEFAULT:NO-SSH-CBC
sudo systemctl restart sshd

Keep the base policy and modules that –show returned and append yours, such as FIPS:NO-SSH-CBC or DEFAULT:AD-SUPPORT:NO-SSH-CBC; setting DEFAULT on a FIPS host moves it off the FIPS policy. The @SSH scope also covers libssh and the host’s ssh client. Red Hat recommends a reboot so every service picks up the new policy.

On RHEL 8, DEFAULT, FIPS and LEGACY all offer aes256-cbc and aes128-cbc to SSH clients (LEGACY also offers 3des-cbc); FUTURE does not. On a FUTURE host, look for an sshd opt-out or override instead.

Scoped (@SSH) and wildcard syntax requires RHEL 8.5 or later (check /etc/redhat-release). On 8.4 and earlier, update to 8.5 or later, or opt sshd out by uncommenting CRYPTO_POLICY= in /etc/sysconfig/sshd and setting Ciphers in /etc/ssh/sshd_config. This works on any RHEL 8 release but bypasses central policy.

RHEL 9 and RHEL 10

RHEL 9’s DEFAULT policy already disables CBC for SSH, so a finding usually means the LEGACY policy or an override. Check update-crypto-policies –show and look for Ciphers lines in /etc/ssh/sshd_config.d/ files numbered below 50, which take precedence over 50-redhat.conf. Remove the override, return to DEFAULT after confirming why LEGACY was set (it also affects TLS), or keep LEGACY and add the module above (LEGACY:NO-SSH-CBC). For a host-specific list, Red Hat documents a drop-in in /etc/ssh/sshd_config.d/ whose two-digit prefix is below 50, so it sorts before 50-redhat.conf, for example /etc/ssh/sshd_config.d/49-crypto-policy-override.conf.

Appliances, Dropbear and very old OpenSSH

If nmap lists blowfish-cbc, cast128-cbc or arcfour, the service is OpenSSH older than 7.6 or another SSH implementation. On appliances, apply a firmware update or the vendor’s SSH hardening setting.

Dropbear has no Ciphers setting at runtime. Upgrade to Dropbear 2020.79 or later, where CBC and 3DES are off by default, or rebuild with #define DROPBEAR_ENABLE_CBC_MODE 0 and #define DROPBEAR_3DES 0 in localoptions.h.

How to verify the fix and rescan

sudo sshd -T | grep -i '^ciphers'
nmap -p 22 --script ssh2-enum-algos <host>
ssh -c aes128-cbc user@<host>

The last command should fail with no matching cipher found. sshd -T reads files on disk, not the running daemon, and on RHEL 8 it ignores the crypto policy unless you use the variant shown earlier, so nmap is what proves the change took effect. Then rescan with the same policy; these network checks need no credentials. If you also run credentialed scans, confirm the scanner still logs in; see our guide to authenticated Linux scanning over SSH with sudo.

What can break and how to roll back

• Old clients and libraries that only speak CBC, such as legacy SFTP integrations, will fail to connect. sshd logs these as “Unable to negotiate … no matching cipher found”: journalctl -u sshd –since today | grep ‘no matching cipher’ (use -u ssh on Debian and Ubuntu).
• Outbound connections: sshd_config affects only inbound SSH, but on RHEL crypto-policies also governs the ssh client, so scripts that SSH to old network gear may break.
• No per-client exception: Ciphers is not permitted inside a Match block, so you cannot allow CBC for a single source address. Upgrade or isolate the legacy client.
• Lockout: restarting sshd normally keeps established sessions, but keep a second root session open, run sshd -t first and have console access.

To roll back a drop-in, delete the file you created (10-ciphers.conf, 49-crypto-policy-override.conf or your own) and restart, using ssh as the service name on Debian and Ubuntu. If you edited the main file, restore the previous Ciphers line instead:

sudo rm /etc/ssh/sshd_config.d/<your-file>.conf && sudo sshd -t && sudo systemctl restart sshd

On RHEL 8, restore the value –show returned before the change, restart sshd and optionally remove the module; Red Hat recommends a reboot:

sudo update-crypto-policies --set <previous value> && sudo systemctl restart sshd
sudo rm /etc/crypto-policies/policies/modules/NO-SSH-CBC.pmod

Common false positive reasons

• A different SSH service answered: a second sshd, a container or Git service on another port, or a NAT rule forwarding port 22 elsewhere. Compare the port and banner in the plugin output.
• sshd was never restarted, so the old process still offers the old list even though sshd -T looks correct.
• RHEL 8 policy override: sshd_config was edited, but the crypto policy still supplies CBC.
• Qualys QID 38739 stays open because it also covers key exchange and MAC algorithms, not just ciphers.
• Stale results: the scan ran before the change window closed.

For other reasons a scanner and a host disagree, see common causes of vulnerability scanner false positives.

FAQ

Is aes256-ctr safe to keep?

Yes. CTR mode is not affected by the CBC plaintext recovery issue, Tenable’s solution text recommends CTR or GCM, and the CTR ciphers are in OpenSSH’s default list.

Do I also need to fix MACs and key exchange?

Not for the Nessus plugins, but scanners report weak MACs and key exchange as separate findings (Qualys QID 38739 includes them), so review MACs and KexAlgorithms at the same time.

Tracking this finding across many hosts

When the same cipher finding appears on dozens of Linux servers, a platform such as SITEY can help. It is self-hosted, imports findings from 16 scanners including Nessus (via uploaded .nessus exports) and OpenVAS, and its AI can draft a host-specific remediation script that its agents deploy on Linux endpoints only after human approval. After the fix, it re-tests to verify closure; per-finding retest is available for Nessus results, and an OpenVAS scan can be launched directly from the platform.

Sources

• Tenable: SSH Server CBC Mode Ciphers Enabled (plugin 70658)
• Tenable: SSH Weak Algorithms Supported (plugin 90317)
• OpenBSD manual: sshd_config(5)
• Red Hat: Using system-wide cryptographic policies (RHEL 8)
• Red Hat: Using system-wide cryptographic policies (RHEL 9)
• Red Hat: Using secure communications between two systems with OpenSSH (RHEL 9)
• OpenSSH release notes
• Dropbear changelog