diff --git a/tasks/configure-ssh-hardening.yml b/tasks/configure-ssh-hardening.yml
index 1ce0dc2ebd46607450a6eda125385984dd3ce9da..cb01036b539b161ff751ffeb898b0f259bca74d1 100644
--- a/tasks/configure-ssh-hardening.yml
+++ b/tasks/configure-ssh-hardening.yml
@@ -47,5 +47,14 @@
       MaxAuthTries 3
       TCPKeepAlive no
       {{ "PasswordAuthentication no" if ansible_os_family == "Debian" else "PasswordAuthentication yes" }}
+      # disable weak host key algorithm ssh-dss (Digital Signature Algorithm (DSA) / Digital Signature Standard (DSS))
+      # NVT OID: 1.3.6.1.4.1.25623.1.0.117687
+      HostKeyAlgorithms -ssh-dss
+      # disable weak KEX algorithms
+      # NVT OID: 1.3.6.1.4.1.25623.1.0.150713
+      KexAlgorithms -diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
+      # disable weak Ciphers (crypto algorithms)
+      # NVT OID: 1.3.6.1.4.1.25623.1.0.105611
+      Ciphers -3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc
   notify:
     - restart sshd