0

I know that ssh config file is parsed from top down and that it uses the options listed for the first valid match, ignoring ones from later valid matches if it already saw that option. I've tried a few different variants of formatting, but with my efforts it seems to either dislike the syntax/formatting, or else ignore the option if it is presented twice under the same host.

I'm using this version:

ssh -V
OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2

For an arbitrary example, the KexAlgorithms option supports explicit lists, or adding and removing from the default set:

Specifies the available KEX (Key Exchange) algorithms. Multiple algorithms must be comma-separated. If the specified list begins with a ‘+’ character, then the specified methods will be appended to the default set instead of replacing them. If the specified list begins with a ‘-’ character, then the specified methods (including wildcards) will be removed from the default set instead of replacing them. If the specified list begins with a ‘^’ character, then the specified methods will be placed at the head of the default set.

https://man7.org/linux/man-pages/man5/ssh_config.5.html

If I wanted to alter the default set to in order to:

  • remove: diffie-hellman-group-exchange-sha256 and also curve25519-sha256
  • add: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

Does anyone know the syntax, or if it's possible to both add and remove, without having to make your own entirely explicit list of all options?

I've tried using the + and - list modifiers in the same line after KexAlgorithms, but it reports that as garbage. If I split them to separate lists (see below) it executes fine but seems to only perform the top KexAlgorithms option, not both.

Host myHost
  HostName myHost.myDomain.com
  KexAlgorithms -"diffie-hellman-group-exchange-sha256,curve25519-sha256"
  KexAlgorithms +"diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1"

And I know I'm removing some secure options there and adding insecure ones, no need to tell me that :-)

Thanks!

UPDATE: As requested ssh -Q kex output:

diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
curve25519-sha256
curv[email protected]
[email protected]
Improve this question
4
  • it executes fine but seems to only perform the top KexAlgorithms option how are you checking that?
    – Eduardo Trápani
    May 13, 2021 at 21:56
  • Checking output when using ssh -vv myHost. When I say 'executes fine' what I mean is it that it isn't reporting that config arrangement as garbage, but still does not both add the given options, and remove the other given options. It will only do one of the two, based on which ever is specified first. I've tried concatenating them into one line, but it only reads the first modifier (say - not the + later in the line).
    – Chris
    May 13, 2021 at 21:57
  • Can you add the output of ssh -Q kex to your question?
    – Eduardo Trápani
    May 13, 2021 at 22:03
  • Done, have added it as an addendum at the bottom of the question. I do notice that some of these don't get highlighted as a 'variable' in and others do, but I've been putting that down to specifics of VIM's syntax highlighting rather than anything more sinister.
    – Chris
    May 13, 2021 at 22:21

1 Answer 1

Reset to default
1

From the manpage you linked:

Since the first obtained value for each parameter is used, more host-specific declarations should be given near the beginning of the file, and general defaults at the end.

That means that if you have KexAlgorithms twice, only the first one will be taken into account.

In the one KexAlgorithms that is used, you can either set, remove or add algorithms, but not a combination of those.

So, you can have your personalized list, but you have to set it, explicitely.

In order to check if it works, instead of the verbose ssh -vv Myhost you can do:

 ssh -G myHost | grep -i kex
Improve this answer
1
  • Yeah, I did see that, I was a bit unsure of how strictly to interpret it. I knew if I had myHost with a KexAlgorithm above myH* with a KexAlgorithm, then it would ignore the myH* specification. I had hoped that two separate lines of KexAlgorithm under just myHost might work, or perhaps, some fancy syntax to get it all in a single KexAlgorithm line under myHost to enable both additions and removals....Not to be it would seem, what you say supports what my experimenting has found too. Thanks.
    – Chris
    May 13, 2021 at 23:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .