Tools

How to disable or enable SSH ciphers, SSH HMACs, and key exchange in Serv-U

This article provides instructions for disabling or enabling specific TLS and SSH ciphers and key exchange in Serv-U.

First published date

5/13/2019 7:48 PM

Last published date

2/17/2022 2:40 AM

Overview

This article describes how you can disable or enable specific TLS and SSH ciphers and key exchange. Serv-U by default enables all of it and it causes failed vulnerability tests because of old and weak ciphers. Also, there are two levels in Serv-U where you can do it. 

This is also very helpful when handling vulnerability issues since you can control which ciphers you want to enable or disable. Depending on the vulnerability found, just refer to the details and perform the necessary actions.
 

Product section

Serv-U Managed File Transfer & Serv-U FTP Server

Cause

N/A

Resolution


To disable SSH Ciphers, MACs, and Key Exchange:
  • Launch the Serv-U Management Console
  • Go to Global or Domains > Limits & Settings > Encryption tab
  • Disable specific SSH Ciphers, MACs and Key Exchanges in the SSH panel
image.png

To disable SSL options such as TLS 1.0, TLS 1.1 and SSLv3:
  • Launch the Serv-U Management Console
  • Go to Global > Limits & Settings > Encryption tab (this option is only available in the Global level and not in the Domain level)
  • Go to the Advanced SSL Options panel
  • Disable the specific TLS versions or SSLv3


To disable SSL ciphers for TLS and SSLv3:
  • Launch the Serv-U Management Console
  • Go to Global > Limits & Settings > Encryption tab (this option is only available in the Global level and not in the Domain level)
  • Go to the Advanced SSL Options panel and click the 'Configure Cipher Suites' button
  • Available ciphers for TLS 1.2 only
  • Available ciphers for TLS 1.1 / TLS 1.0 and SSLv3


Note:
  • All screenshots above are from Serv-U version 15.2.1. The available ciphers will vary depending on the Serv-U version installed
  • Enabling FIPS 140-2 in Serv-U will remove the capability to configure SSL options and ciphers since FIPS 140-2 mode overrides these options.
  • Disabling SFTP Key Exchanges requires at least Serv-U version 15.1.6.25
  • Disabling old TLS version like v1.0 and v1.1 will only affect clients who still uses this TLS version via FTP/FTPS , HTTP and HTTPS wherein they will not able to connect.