Hardening SSH on vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

Security or compliance scans often flag the /etc/ssh/moduli file on vCenter servers because it contains pre-generated group parameters for Diffie-Hellman Key Exchange (KEX) that are shorter than 3071 bits. These smaller entries are considered vulnerable to known attacks.

Environment

VMware vCenter Server

Resolution

To satisfy compliance requirements, you must restrict the Key Exchange algorithms and remove the weak moduli entries.

Step-by-Step Remediation

1. Verify Current Settings (Optional but Recommended): Check your currently supported KEX algorithms:

ssh -Q kex

Check your server's current effective KEX configuration:

sshd -T | grep ^kexalgorithms

2. Restrict SSH to Modern KEX Algorithms: Edit your sshd configuration file (/etc/ssh/sshd_config) to include only secure algorithms. Add or modify the following line:

KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,ecdh-sha2-nistp256

3. Restart the SSH Service: Apply the new configuration by restarting the SSH daemon:

systemctl restart sshd

4. Remove Weak Moduli Entries: Filter out any moduli smaller than 3071 bits and replace the original file with the secure entries:

# Check for weak moduli (Compliance Check)
awk '$5 < 3071' < /etc/ssh/moduli

# Create a new file with only secure moduli (>= 3071 bits)
awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe

# Take a backup of /etc/ssh/moduli
cp -a /etc/ssh/moduli /etc/ssh/moduli.bak

# Replace the old file with the safe file
mv /etc/ssh/moduli.safe /etc/ssh/moduli