How to Disable SHA1 and Enable SHA2 for App Connector VM

TABLE OF CONTENTS

• Product Details
• Issue/ Problem
• Impact
• Solution
• Best Practice
• Summary

Product : Zscaler Private Access (ZPA) App Connector

Component : Zscaler Client App

Version : 2.8.17  Build No. : 152.2

Issue/ Problem :

Customer request to Disable SHA1 and Enable SHA2 for App Connector VM after done Vulnerability Scanning

Impact :

No Impact but Increase Security as using SHA2

Solution : 

Step 1:

Go to below directory and uncomment the below line

Vi /etc/sysconfig/sshd

Uncomment

CRYPTO_POLICY=

Step 2:

Go to the below directories and append the below lines at the end of file

vi /etc/ssh/sshd_config

KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256

Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com

Step 3:

systemctl restart sshd

sudo ssh -Q key

sudo SSH -t

Summary : 

 The method is only applied if customer request to rectify the SHA1 Ciphers after Vulnerability Scanning