I have an issue that I cannot connect with ubuntu focal (in a container) to a server behind a palo alto It works with xenial and bionic The difference we see there is the Cipher sent for key exchange

I wanted to test with the same ciphers, but there comes my issue: Neither with

Cipher [email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

in /etc/ssh/ssh_config nor with

-o [email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

( I tested both also only with one Cipher as option)

You see in both cases via wireshark dump that all Ciphers are sent. How do you restrict sending the ciphers at all

1 Answer 1


You can add the Ciphers configuration into your users ssh/config file e.g.

Host whatsit
   HostName whats.it
   User Thor
   Cyphers arcfour,blowfish-cbc
   IdentityFile ~/.ssh/thor@whatsit

Then when you want to login the ssh client will over accept arc four and blowfish-cbc to the remote server. Of course it might reject them as insecure. So AES ciphers are recommended as they are both fast and secure.

e.g. Usage of whatsit host defined in .ssh/config ssh whatit


sftp whatit

As you wish..

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .