Administrators can determine
which client systems do not have sufficient security levels and either
update them to the higher level or decrease the system security level
until these systems are updated.
You cannot simultaneously change the
SSL/TLS and the SSH settings by using the chsecurity command. Change one type of security level, and then check that
the system is still accessible before changing the other type of security
level.
To change security
level settings by using the command-line interface, complete these
steps:
- To change SSL/TLS settings, enter chsecurity -sslprotocol
security_level, where security_level is
one of the following values:
Table 1. Supported SSL/TLS security levels. Supported SSL/TLS security levels
| Security level |
Description |
Minimum security allowed |
| 1 |
Sets the system to disallow SSL version 3.0. |
TLS 1.0 |
| 2 |
Sets the system to disallow SSL version 3.0,
TLS version 1.0, and TLS version 1.1. |
TLS 1.2 |
| 3 |
Sets the system to disallow SSL version 3.0,
TLS version 1.0, and TLS version 1.1 and to allow cipher suites that
are exclusive to TLS version 1.2. |
TLS 1.2 |
| 4 |
Sets the system to disallow SSL version 3.0,
TLS version 1.0, and TLS version 1.1 and to allow cipher suites that
are exclusive to TLS version 1.2. Sets the system to disallow RSA
key exchange ciphers, RSA ciphers for SSH. |
TLS 1.2 |
Note: Users might lose the connection to the management GUI when the security level is changed. If you lose the connection,
use the CLI to decrease the security level to a lower setting.
- To change SSH settings, enter chsecurity -sshprotocol security_level, where security_level is one of the following values:
Table 2. Supported SSH security levels. Supported SSH security levels
| Security level |
Description |
| 1 |
Allows the following key exchange methods:
- curve25519-sha256
- curve25519-sha256@libssh.org
- ecdh-sha2-nistp256
- ecdh-sha2-nistp384
- ecdh-sha2-nistp521
- diffie-hellman-group-exchange-sha256
- diffie-hellman-group16-sha512
- diffie-hellman-group18-sha512
- diffie-hellman-group14-sha256
- diffie-hellman-group14-sha1
- diffie-hellman-group1-sha1
- diffie-hellman-group-exchange-sha1
|
| 2 |
Allows the following key exchange methods:
- curve25519-sha256
- curve25519-sha256@libssh.org
- ecdh-sha2-nistp256
- ecdh-sha2-nistp384
- ecdh-sha2-nistp521
- diffie-hellman-group-exchange-sha256
- diffie-hellman-group16-sha512
- diffie-hellman-group18-sha512
- diffie-hellman-group14-sha256
- diffie-hellman-group14-sha1
|