But the gist of it is PermitRootLogin no in your sshd_config and Protocol 2 (to disable protocol 1), PubkeyAuthentication yes Password authentication no
For this specific vulnerability those will not do, as this exploit is for post-authentication, whether password or pubkey doesnt matter.
Hence, you can add Ciphers blowfish-cbc
which will only allow that cipher to be used.
Also add MACs hmac-sha2-512 to only allow that MAC and none, weaker, others.
But the gist of it is PermitRootLogin no in your sshd_config and Protocol 2 (to disable protocol 1), PubkeyAuthentication yes Password authentication no
For this specific vulnerability those will not do, as this exploit is for post-authentication, whether password or pubkey doesnt matter.
Hence, you can add Ciphers blowfish-cbc which will only allow that cipher to be used.
Also add MACs hmac-sha2-512 to only allow that MAC and none, weaker, others.