A Vulnerability of SHA1 deprecated setting for SSH is detected during an audit scan for Juniper Security Director running version 21.3R1. The scan results are as below.
Detected Ciphers Result
Type Name
key exchange diffie-hellman-group14-sha1
host key algorithm ssh-rsa
MAC hmac-sha1#
Audit scan for Juniper Security Director running 21.3R1 version reveals the below vulnerability.
JunOS Space supports the below supported algorithms for SSH. The link to the document containing this information is https://www.juniper.net/documentation/us/en/software/junos-space21.3/junos-space-workspaces/topics/concept/platform-key-based-authentication-overview.html#device-authentication-in-junos-space-overview__d8574e116.
Since JunOS Space doesn't use the algorithms mentioned in the scan result, we can remove these algorithms from the SSH configuration files mentioned below.
You can remove it from the below files. Please take a backup of these files by moving them to the /tmp directory before making any changes.
# cat /etc/ssh/sshd_config
# cat /etc/ssh/ssh_config
If you don't want to remove the cipher suites, you can "comment" it using #.
Once done, please restart the ssh service using the command "systemctl restart sshd". Post the restart of the sshd service, please run a vulnerability scan to verify that the vulnerability is not detected anymore.