sshd minimum encryption

crimsontide · 06-05-2006, 03:59 PM

Where do I define the minimum level of encryption accepted by my sshd server?

I want clients to only be able to connect at AES. Can't I specify this on the server side?

Still new to all this.

Thanks!

david_ross · 06-05-2006, 04:27 PM

From "man sshd_config":

Code:

     Ciphers
             Specifies the ciphers allowed for protocol version 2.  Multiple
             ciphers must be comma-separated.  The supported ciphers are
             ``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'', ``aes256-cbc'',
             ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'', ``arcfour128'',
             ``arcfour256'', ``arcfour'', ``blowfish-cbc'', and
             ``cast128-cbc''.  The default is

               ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
                 arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
                 aes192-ctr,aes256-ctr''

Synesthesia · 06-05-2006, 11:58 PM

As far as I know you cannot use the sshd server to force clients to use a certain encryption algorithm. Arguably, there is no "minimum" encryption, since all of the cyphers scrable the data in a different way. Luckily, all of the algorithms ssh (i would always use the 2nd protocol version) uses are pretty widely trusted. Blowfish is decent, and that is what most ssh connection default to (if cypher is unspecified). AES and blowfish are both considered some of the strongest encryption algorithms out there.

crimsontide · 06-06-2006, 07:57 AM

Perfect guys!

Thanks!