ssh server cipher

Function

The ssh server cipher command configures an encryption algorithm list for an SSH server.

The undo ssh server cipher command restores the default encryption algorithm list of an SSH server.

By default, an SSH server supports five encryption algorithms: AES128_CTR and AES256_CTR.

Format

ssh server cipher { aes128_ctr | aes256_ctr | blowfish_cbc } ^*

undo ssh server cipher

Parameters

Parameter	Description	Value
aes128_ctr	Specifies the CTR AES128 encryption algorithm.	-
aes256_ctr	Specifies the CTR AES256 encryption algorithm.	-

Views

System view

Default Level

3: Management level

Usage Guidelines

Usage Scenario

An SSH server and a client need to negotiate an encryption algorithm for the packets exchanged between them. You can run the ssh server cipher command to configure an encryption algorithm list for the SSH server. After the SSH server receives a packet from the client, the server matches the encryption algorithm list of the client against its local list and selects the first matched encryption algorithm. If no matched encryption algorithms, the negotiation fails.

Precautions

The security levels of encryption algorithms are as follows, from high to low: aes256_ctr, aes128_ctr.

aes256_cbc, aes128_cbc, 3des_cbc and des_cbc provide weak security. Therefore, they are not recommended in the encryption algorithm list.

The system software does not support the aes256_cbc, aes128_cbc, 3des_cbc, and des_cbc parameters. To use these parameters, you need to install the WEAKEA plug-in. For higher security purposes, you are advised to specify the aes256_ctr or aes128_ctr parameter.

In V200R019C00 and later versions, when the device starts with the default configurations, it automatically performs the following configurations and saves the configurations to the configuration file:

Run the ssh server dh-exchange min-len 2048 command to set the minimum key length supported during Diffie-hellman-group-exchange key exchange between the SSH server and client to 2048 bytes.
Run the ssh server cipher aes256_ctr aes128_ctr command to configure CTR encryption algorithms for an SSH server.
Run the ssh server hmac sha2_256 command to configure the HMAC SHA2_256 algorithm for an SSH server.
Run the ssh client cipher aes256_ctr aes128_ctr command to configure CTR encryption algorithms for an SSH client.
Run the ssh client hmac sha2_256 command to configure the HMAC SHA2_256 algorithm for an SSH client.

Example

# Configure CTR encryption algorithms for an SSH server.

<HUAWEI> system-view
[HUAWEI] ssh server cipher aes256_ctr aes128_ctr