SSH Weak Message Authentication Code Algorithms

How to disable any MD5 or 96-bit HMAC algorithms within the SSH configuration. 

If the default SSH options are in place, MD5 or 96-bit HMAC algorithms are enabled by default, and could pose a vulnerability if the port is open to unwanted access.

You can configure SSH to only use the hashes you want under this configuration:

# set system services ssh macs ?

Possible completions:

 [          Open a set of values

 hmac-md5       Hash-based MAC using Message-Digest 5 (MD5)

 hmac-md5-96     96-bits of Hash-based MAC using MD5

 [email protected] 96-bits of Hash-based Encrypt-then-MAC using MD5

 [email protected] Hash-based Encrypt-then-MAC using Message-Digest 5 (MD5)

 hmac-ripemd160    Hash-based MAC using RIPEMD

 [email protected] Hash-based Encrypt-then-MAC using RIPEMD

 hmac-sha1      Hash-based MAC using Secure Hash Algorithm (SHA1)

 hmac-sha1-96     96-bits of Hash-based MAC using SHA1

 [email protected] 96-bits of Hash-based Encrypt-then-MAC using SHA1

 [email protected] Hash-based Encrypt-then-MAC using Secure Hash Algorithm (SHA1)

 hmac-sha2-256    Hash-based MAC using Secure Hash Algorithm (SHA2)

 [email protected] Hash-based Encrypt-then-Mac using Secure Hash Algorithm (SHA2)

 hmac-sha2-512    Hash-based MAC using Secure Hash Algorithm (SHA2)

 [email protected] Hash-based Encrypt-then-Mac using Secure Hash Algorithm (SHA2)

 [email protected] Encrypt-then-MAC using UMAC-128 algorithm specified in RFC4418

 [email protected] UMAC-128 algorithm specified in RFC4418

 [email protected] Encrypt-then-MAC using UMAC-64 algorithm specified in RFC4418

 [email protected] UMAC-64 algorithm specified in RFC4418

To not use md5 or 96 hashes you could enable the rest:

set system services ssh macs hmac-ripemd160

set system services ssh macs "[email protected]"

set system services ssh macs hmac-sha1

set system services ssh macs "[email protected]"

set system services ssh macs hmac-sha2-256

set system services ssh macs "[email protected]"

set system services ssh macs hmac-sha2-512

set system services ssh macs "[email protected]"

set system services ssh macs "[email protected]"

set system services ssh macs "[email protected]"

set system services ssh macs "[email protected]"

set system services ssh macs "[email protected]"

Please use caution when commiting this. Commit confirm is a good idea to autorollback in case you lose ssh access after this.

 https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/ssh-edit-system.html