I know that ssh config file is parsed from top down and that it uses the options listed for the first valid match, ignoring ones from later valid matches if it already saw that option. I've tried a few different variants of formatting, but with my efforts it seems to either dislike the syntax/formatting, or else ignore the option if it is presented twice under the same host.
I'm using this version:
ssh -V OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2
For an arbitrary example, the KexAlgorithms option supports explicit lists, or adding and removing from the default set:
Specifies the available KEX (Key Exchange) algorithms. Multiple algorithms must be comma-separated. If the specified list begins with a ‘+’ character, then the specified methods will be appended to the default set instead of replacing them. If the specified list begins with a ‘-’ character, then the specified methods (including wildcards) will be removed from the default set instead of replacing them. If the specified list begins with a ‘^’ character, then the specified methods will be placed at the head of the default set.
If I wanted to alter the default set to in order to:
- remove: diffie-hellman-group-exchange-sha256 and also curve25519-sha256
- add: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
Does anyone know the syntax, or if it's possible to both add and remove, without having to make your own entirely explicit list of all options?
I've tried using the + and - list modifiers in the same line after KexAlgorithms, but it reports that as garbage. If I split them to separate lists (see below) it executes fine but seems to only perform the top KexAlgorithms option, not both.
Host myHost HostName myHost.myDomain.com KexAlgorithms -"diffie-hellman-group-exchange-sha256,curve25519-sha256" KexAlgorithms +"diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1"
And I know I'm removing some secure options there and adding insecure ones, no need to tell me that :-)
UPDATE: As requested
ssh -Q kex output:
diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 diffie-hellman-group-exchange-sha1 diffie-hellman-group-exchange-sha256 ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 curve25519-sha256 curv[email protected] [email protected]