The neat thing about RHEL is that there's a single 'crypto-policies' package which configures available TLS versions and algorithms for everything in the system: TLS, SSH, IPSec, DNSSEC, Kerberos and so on.

Regarding SSH, the FUTURE policy removes AES128, HMAC-SHA1 and DH Group 14.