I would like to disallow certain ciphers for OpenSSH in Fedora.
I've read that Fedora overrides settings in sshd_config with its crypto policies.
I'd like to edit those.

My first idea would be to edit /etc/crypto-policies/back-ends/opensshserver.config, but I wonder if that is the recommended way of doing this.

2 Answers 2


You can control settings like encryption ciphers and quite a few other parameters (key exchange algorithms, host-key algorithms, MAC algorithms) under /etc/ssh/sshd_config respectively using parameters Ciphers, KexAlgorithms, HostKeyAlgorithms and MACs. See https://man.openbsd.org/sshd_config for more information.

Software like ssh-audit (https://github.com/arthepsy/ssh-audit.git) can help you work out what could do with changing.

Disallowing a cipher happens if you don't list it as an option.

  • 1
    I've read that Fedora overrides this with its crypto policies. I'd like to edit those.
    – markonius
    Apr 29, 2020 at 15:55
  • Thanks for ssh-audit, it seems useful
    – markonius
    Apr 29, 2020 at 15:57
  • Adjustment to e.g. KexAlgorithms via /etc/ssh/sshd_config don't work on my Fedora 33 host.
    – HorstKevin
    Mar 27, 2021 at 13:35

Editing KexAlgorithms in /etc/ssh/sshd.config won't show any effect, at least not on my Fedora 33 system.

But as you pointed out yourself, you can edit /etc/crypto-policies/back-ends/opensshserver.config and systemctl restart sshd afterwards. That works perfectly fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.