> Source: [sk184713](https://support.checkpoint.com/results/sk/sk184713)

# sk184713 - Vulnerability scanners report that deprecated SSH host key algorithm (SHA-1 and RSA) is enabled on a Gaia OS server

| Property | Value |
|----------|-------|
| Solution ID | sk184713 |
| Date Created | 2026-03-16 |
| Last Modified | 2026-03-29 |
| Technical Level | Advanced |
| Products | Security Gateway, Security Management Server |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R82.10, R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * External vulnerability scanners (for example, Qualys) report that "SHA-1" and "RSA" (ssh-rsa) are enabled / advertised on a Gaia OS server.

* Examination of the SSH settings in the Gaia CLI shows only modern SSH ciphers, key-exchange algorithms, and Message Authentication Codes (MACs).

* The SSH daemon configuration file "`/etc/ssh/sshd_config`" in the Gaia OS shows that RSA and DSA host keys are configured.

  For example:
  * `HostKey /etc/ssh/ssh_host_rsa_key`
  * `HostKey /etc/ssh/ssh_host_dsa_key`

## Cause

In the Gaia OS, the SSH cipher / key-exchange / MAC settings shown in the Gaia CLI do not control which SSH host key algorithms the SSH daemon offers.

The active SSH daemon configuration (`/etc/ssh/sshd_config`) is generated from this Gaia template file:

`/etc/ssh/templates/sshd_config.templ`

This template still includes RSA (and sometimes DSA) HostKey entries.

When RSA host keys are enabled, the SSH service can advertise the deprecated "ssh-rsa" algorithm (RSA signatures with Secure Hash Algorithm 1), which vulnerability scanners flag.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content