Skip to main content
Version: v45

Supported SSH Algorithms

This article describes the default and supported SSH algorithms in PrivX.

PrivX supports the SSH algorithms listed below. To configure algorithms other than host-key algorithms, edit /opt/privx/etc/ssh-algorithms.toml on PrivX Servers. You can enable algorithms for specific targets by FQDN pattern, CIDR range, or IP address.

tip

Some algorithms are disabled by default because they are no longer considered secure. Upgrade the target host to support the default algorithms if possible. Enable legacy algorithms only if upgrading the target host is not an option.

KEX Algorithms​

Default key-exchange (KEX) algorithms:

All supported KEX algorithms:

note

The diffie-hellman-group-exchange-* key-exchange algorithms are supported only when PrivX connects to targets, not when clients connect to PrivX Bastion.

Host-Key Algorithms​

Ciphers​

Default ciphers:

All supported ciphers:

MACs​

Default MACs:

  • hmac-sha2-512
  • hmac-sha2-256
  • hmac-sha1
  • hmac-sha1-96

All supported MACs:

note

The legacy *-etm@openssh.com message authentication codes cannot be used together with the legacy *-cbc ciphers due to a limitation in the underlying cryptographic stack, not in PrivX itself.

SFTP Protocols​

Default version: 6.

Supported versions: 3, 4, 5, 6.

Page updated on