3

Used for a few years arcfour as default cipher for SSH2 connection in my ~/.ssh/config file

host namaka
    hostname localhost
    port 2022
    ciphers arcfour
    IdentityFile ~/.ssh/virtualbox
    compression true
    StrictHostKeyChecking no
    user kermit 

After an upgrade to Debian 8 I have discovered this cipher has been disabled from default ssh configuration and I was getting the following error

no matching cipher found: client arcfour server aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com

So I changed my ~/.ssh/config to

host namaka
    hostname localhost
    port 2022
    ciphers aes256-ctr
    IdentityFile ~/.ssh/virtualbox
    compression true
    StrictHostKeyChecking no
    user kermit

(notice the cipher aes256) and now my ssh connection are working again.

kermit@euroforce:~$ ssh kermit@namaka

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Jul 16 00:20:21 2015 from 10.0.2.2
kermit@namaka:~$ 

Unfortunately I am still getting the no matching cipher error when I try to do an scp

kermit@euroforce:~$ scp foo  kermit@namaka:/tmp/
no matching cipher found: client arcfour server aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
lost connection

It seems scp has cached somewhere the previous cipher and does not want to use the new one.

Forcing the cipher from command line does work

kermit@euroforce:~$ scp -c aes256-ctr foo  kermit@namaka:/tmp/foo2
foo                                                                 100%    0     0.0KB/s   00:00  

Forcing the config file does not work

kermit@euroforce:~$ scp -C .ssh/config foo  kermit@namaka:/tmp/foo2
no matching cipher found: client arcfour server aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
lost connection

Any clue?

5
  • The flag to pass a config file is -F, not -C. (Don't know why it's not picking it up by default though.)
    – Mat
    Aug 5 '15 at 7:20
  • 5
    Try running scp with -vvv; that should tell you why it does that. Aug 5 '15 at 7:22
  • There you go link: even with -F the result does not change Aug 8 '15 at 12:39
  • Why do you want to force the cipher at all? arcfour has been removed for security reasons.
    – sebix
    Aug 17 '15 at 19:03
  • I want to use a "lightweight" cipher to speed up my connection (especially when forwarding a X session). By the way: I am not asking help to use arcfour, I am asking why, even if I removed arcfour from my config, scp tries to use it (instead of aes) Aug 18 '15 at 6:38
3

I've found the culprit: it was a bash alias I created a few years ago and then forgot

alias scp='scp -c arcfour'

Shame on me

2
  • How funny -- turns out I had done the same thing, only for ssh. I added it years ago to speed up local X11 forwarding.
    – Roger Dahl
    Jul 29 '16 at 2:49
  • Using ~/bin/scp being a symlink to ssh-ident didn't help either.
    – Tom Hale
    Apr 17 '17 at 6:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.