I'm running ubuntu on an Amazon EC2 server - I need to lock down the ssh ciphers for pci compliance. I have tried editing the /etc/ssh/sshd_config, with these lines:
Ciphers aes256-ctr,aes192-ctr,aes128-ctr
KexAlgorithms diffie-hellman-group-exchange-sha256
MACs hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
and restarted the server. However, this command:
ssh -Q cipher localhost
still lists a full range of ciphers that I no longer want. Is there some configuration I'm missing?
ssh version is OpenSSH_6.6.1p1 Ubuntu-2ubuntu2, OpenSSL 1.0.1f 6 Jan 2014
Linux is: Linux ip-172-31-34-22 3.13.0-36-generic #63-Ubuntu SMP Wed Sep 3 21:30:07 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
Thanks for any advice.