Ssh – Specifying ciphers and protocol 2 in .ssh/config

ssh

I would like to be able to specify in my .ssh/config file that ssh uses protocol 2 (command line argument -2), and which ciphers to use with it.

The following does not seem to work (I get bad configuration option: Cyphers)

Host XXX
    HostName YYYY
    User ZZZZ
    Compression no
    Cyphers arcfour,blowfish-cbc
    ControlPath ~/.ssh/%r@%h:%p
    IdentityFile ~/.ssh/seas/id_rsa

Also, how do I know which version of ssh (or OpenSSH) I am using? which ssh or man ssh does not reveal much information.

Best Answer

Cyphers should be typed Ciphers
To specify a protocol use the syntax: Protocol X where X can 1 or 2 (2 is the default)

Try man ssh_config

Related Solutions

SSH Gateway in ~/.ssh/config

The two settings do the same thing. The -W option was added in 2010 and is described as a “netcat mode”.

Use ssh -W if you don't need compatibility with versions of OpenBSD prior to 4.7 or with portable OpenSSH prior to 5.5 (I think). Use nc if you do need to support older versions of OpenSSH. ssh -W is preferable if available because it's marginally more efficient and doesn't require a separate utility to be installed.

Disable Weak Ciphers in SSH – How to Enhance SSH Security

If you have no explicit list of ciphers set in ssh_config using the Ciphers keyword, then the default value, according to man 5 ssh_config (client-side) and man 5 sshd_config (server-side), is:

            aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
            aes128-gcm@openssh.com,aes256-gcm@openssh.com,
            chacha20-poly1305@openssh.com,
            aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
            aes256-cbc,arcfour

Note the presence of the arcfour ciphers. So you may have to explicitly set a more restrictive value for Ciphers.

ssh -Q cipher from the client will tell you which schemes your client can support. Note that this list is not affected by the list of ciphers specified in ssh_config. Removing a cipher from ssh_config will not remove it from the output of ssh -Q cipher. Furthermore, using ssh with the -c option to explicitly specify a cipher will override the restricted list of ciphers that you set in ssh_config and possibly allow you to use a weak cipher. This is a feature that allows you to use your ssh client to communicate with obsolete SSH servers that do not support the newer stronger ciphers.

nmap --script ssh2-enum-algos -sV -p <port> <host> will tell you which schemes your server supports.

Best Answer

Related Solutions

SSH Gateway in ~/.ssh/config

Disable Weak Ciphers in SSH – How to Enhance SSH Security

Related Question