I have an issue that I cannot connect with ubuntu focal (in a container) to a server behind a palo alto It works with xenial and bionic The difference we see there is the Cipher sent for key exchange

I wanted to test with the same ciphers, but there comes my issue: Neither with

Cipher ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

in /etc/ssh/ssh_config nor with

-o Cipher=ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

( I tested both also only with one Cipher as option)

You see in both cases via wireshark dump that all Ciphers are sent. How do you restrict sending the ciphers at all


You can add the Ciphers configuration into your users ssh/config file e.g.

Host whatsit
   HostName whats.it
   User Thor
   Cyphers arcfour,blowfish-cbc
   IdentityFile ~/.ssh/thor@whatsit

Then when you want to login the ssh client will over accept arc four and blowfish-cbc to the remote server. Of course it might reject them as insecure. So AES ciphers are recommended as they are both fast and secure.

e.g. Usage of whatsit host defined in .ssh/config ssh whatit


sftp whatit

As you wish..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.