Administrators can determine which client systems do not have
sufficient security levels and either update them to the higher level or decrease the system
security level until these systems are updated.
You cannot simultaneously change the SSL/TLS and the SSH settings by using the
chsecurity command. Change one type of security level, and then check that the
system is still accessible before changing the other type of security level.
To change security level settings by using the command-line interface,
complete these
steps:
- To change SSL/TLS settings, enter chsecurity -sslprotocol security_level,
where security_level is one of the following values:
Table 1. Supported SSL/TLS
security levels
| Security level |
Description |
Minimum security allowed |
| 1 |
Sets the system to disallow SSL version 3.0. |
TLS 1.0 |
| 2 |
Sets the system to disallow SSL version 3.0, TLS version 1.0, and TLS version
1.1. |
TLS 1.2 |
| 3 |
Sets the system to disallow SSL version 3.0, TLS version 1.0, and TLS version
1.1 and to allow cipher suites that are exclusive to TLS version 1.2. |
TLS 1.2 |
| 4 |
Sets the system to disallow SSL version 3.0, TLS version 1.0, and TLS version
1.1 and to allow cipher suites that are exclusive to TLS version 1.2. Sets the system to disallow
RSA key exchange ciphers, RSA ciphers for SSH. |
TLS 1.2 |
Note: Users might lose the connection to the
management GUI when the security level is changed. If you lose the connection, use the CLI to
decrease the security level to a lower setting.
- To change SSH settings, enter chsecurity -sshprotocol security_level, where
security_level is one of the following values:
Table 2. Supported SSH security levels
| Security level |
Description |
| 1 |
Allows the following key exchange methods:
- curve25519-sha256
- curve25519-sha256@libssh.org
- ecdh-sha2-nistp256
- ecdh-sha2-nistp384
- ecdh-sha2-nistp521
- diffie-hellman-group-exchange-sha256
- diffie-hellman-group16-sha512
- diffie-hellman-group18-sha512
- diffie-hellman-group14-sha256
- diffie-hellman-group14-sha1
- diffie-hellman-group1-sha1
- diffie-hellman-group-exchange-sha1
|
| 2 |
Allows the following key exchange methods:
- curve25519-sha256
- curve25519-sha256@libssh.org
- ecdh-sha2-nistp256
- ecdh-sha2-nistp384
- ecdh-sha2-nistp521
- diffie-hellman-group-exchange-sha256
- diffie-hellman-group16-sha512
- diffie-hellman-group18-sha512
- diffie-hellman-group14-sha256
- diffie-hellman-group14-sha1
|