SSH works with a combination of symmetric and asymmetric cryptography, similar to how Transport Layer Security works. The SSH client starts the process by using the public key method to set up an asymmetric session with an SSH server. Once this session has been set up, the two machines can agree on and exchange a secret code, which they'll use to set up a symmetric session. (As we saw previously with TLS, we want to use symmetric cryptography for performance reasons, but we need an asymmetric session to perform the secret key exchange.) To perform this magic, we need four classes of encryption algorithms, which we'll configure on the server side. These are as follows:

• Ciphers: These are the symmetric algorithms that encrypt the data that the client and server exchange with each other.
• HostKeyAlgorithms: This is the list of host key types that the server can use.
• KexAlgorithms: These are the algorithms that the server can use to perform the symmetric key exchange.
• MAC: Message Authentication Codes are hashing algorithms that cryptographically sign the encrypted data in transit. This ensures data integrity and will let you know if someone has tampered with your data.

The best way to get a feel for this is to look at the sshd_config man page, like this:

man sshd_conf

I could use any VM to demo this. For now, though, I'm going with CentOS 7, unless I state otherwise. (The lists of default and available algorithms will be different for different Linux distributions and versions.)

First, let's look at the list of supported ciphers. Scroll down the man page until you see them:

3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
aes128-ctr
aes192-ctr
aes256-ctr
[email protected]
[email protected]
arcfour
arcfour128
arcfour256
blowfish-cbc
cast128-cbc
[email protected]

However, not all of these supported ciphers are enabled. Just below this list, we can see the list of ciphers that are enabled by default:

[email protected],
aes128-ctr,aes192-ctr,aes256-ctr,
[email protected],[email protected],
aes128-cbc,aes192-cbc,aes256-cbc,
blowfish-cbc,cast128-cbc,3des-cbc

Next, in alphabetical order, are the HostKeyAlgorithms. The list on CentOS 7 looks like this:

[email protected],
[email protected],
[email protected],
[email protected],
[email protected],
[email protected],
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
ssh-ed25519,ssh-rsa,ssh-dss

Next, scroll down to the KexAlgorithms (short for Key Exchange Algorithms) section. You'll see a list of supported algorithms, which looks like this:

curve25519-sha256
[email protected]
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521

Be aware that this list can vary from one distribution to the next. For example, RHEL 8/CentOS 8 supports three additional algorithms that are newer and stronger. Its list looks like this:

curve25519-sha256
[email protected]
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521

Next, you'll see the list of algorithms that are enabled by default:

curve25519-sha256,[email protected],
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
diffie-hellman-group-exchange-sha256,
diffie-hellman-group14-sha1,
diffie-hellman-group1-sha1

This list can also vary from one Linux distribution to another. (In this case, though, there's no difference between CentOS 7 and CentOS 8.)

Finally, we have the MAC algorithms. The default list of enabled algorithms looks like this on CentOS 7:

[email protected],[email protected],
[email protected],[email protected],
[email protected],
[email protected],[email protected],
hmac-sha2-256,hmac-sha2-512,hmac-sha1,
[email protected]

To see the list of algorithms that your particular system supports, either look at the sshd_config man page for that machine or perform the following ssh -Q commands:

ssh -Q cipher
ssh -Q key
ssh -Q kex
ssh -Q mac

When you look in the /etc/ssh/sshd_config file, you won't see any lines that configure any of these algorithms. That's because the default list of algorithms is hard coded into the SSH daemon. The only time you'll configure any of these is if you want to either enable an algorithm that isn't enabled or disable one that is. Before we do that, let's scan our system to see what is enabled and see if the scanner can make any recommendations.