SecureSH cipher issues...

[Dave Cast]

All,

     I'm trying to disable all ciphers associated with cbc (cipher block chaining) in secure-shell (Hpux 11.31) - but when I specify (in sshd_config):

"Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour128,arcfo
ur256,arcfour"

and then I try to restart secure-shell and receive the error:

-------------------------------------------------------------------------------------------------------------------------------------

# ./secsh start
/opt/ssh/etc/sshd_config line 20: Bad SSH2 cipher spec 'aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour128,arcfour256,arcfour'.
EXIT CODE: 255
#

-------------------------------------------------------------------------------------------------------------------------------------

However these ciphers are specifically stated as valid in the man page (man sshd_config) on that server.

Any ideas?

P.S. This thread has been moved from HP-UX > General  to HP-UX > security.  Hp Forum Moderator

[Patrick Wallek]

Do you have the "Protocol 2" specified in the sshd_config as well?  

Here is what I had to specify in my sshd-config file to get it to work:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour128,arcfour256,arcfour

Basically I just removed this entry from your list: aes128-gcm@openssh.com

That is not in the list of supported ciphers in the sshd_config man page.

[Dave Cast]

Hi Patrick,

Yes, I do have Protocol 2 specified in sshd_config.   And still receive this error:

# /sbin/init.d/secsh start
/opt/ssh/etc/sshd_config line 20: garbage at end of line; "aes192-ctr,".
EXIT CODE: 255
#

I've attached a copy of my sshd_config file.

[Patrick Wallek · Accepted solution]

Take the spaces out of your Ciphers line.  It should look like this:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour128,arcfour256,arcfour

 The only space should be after the word "Ciphers".

[Dave Cast]

Interesting - ok I took out the spaces (it looked like there were spaces after each cipher, due to my font - and everything works, sheez.

Also, aes128-gcm@openssh.com is supported according to the man page for this system.  But it doesn't like it.

THANKS.