Supported Algorithms for SSH Connections

Edit online

Command Central 10.5 and higher uses strong Key Exchange Algorithms (KEX), Message Authentication Codes (MAC), cyphers and digital signatures that meet the current security requirements for SSH connections. You can modify the list of KEXs that Command Central allows.

Key Exchange Algorithms

By default, Command Central uses the following key exchange methods (listed in order of highest to lowest priority):

  • diffie-hellman-group14-sha256
  • diffie-hellman-group16-sha512
  • diffie-hellman-group18-sha512
  • diffie-hellman-group14-sha1

In addition, Command Central also supports the following key exchange methods:

  • curve25519-sha256
  • curve25519-sha256@libssh.org
  • curve448-sha512
  • diffie-hellman-group1-sha1
  • diffie-hellman-group15-sha512
  • diffie-hellman-group17-sha512
  • diffie-hellman-group-exchange-sha256
  • ecdh-sha2-nistp256
  • ecdh-sha2-nistp384
  • ecdh-sha2-nistp521
Note:

The diffie-hellman-group1-sha1 key exchange method is supported, but disabled by default, because it is weak. Enable it only when required by the environment.

You can use the com.webmethods.platform.management.client.remoteaccess.allowedkexmethods property to control the list of key exchange methods used by Command Central. For more information about the property, see SSH Connections.

If the OpenSSH server on the remote machine does not use any of the key exchange methods allowed by Command Central, you can configure the OpenSSH server to use one or more of the allowed methods. For more information, see Configuring an OpenSSH Server to Use the Key-Exchange Methods Allowed by Command Central.

MACs

Command Central uses the following MACs in order of priority:

  • hmac-sha2-256-etm@openssh.com
  • hmac-sha2-512-etm@openssh.com
  • hmac-sha1-etm@openssh.com
  • hmacsha256
  • hmacsha512
  • hmacsha1

Ciphers

Command Central uses the following ciphers in order of priority:

  • chacha20-poly1305@openssh.com
  • aes128-ctr
  • aes192-ctr
  • aes256-ctr
  • aes128-gcm@openssh.com
  • aes256-gcm@openssh.com
  • aes128-cbc
  • aes192-cbc
  • aes256-cbc

Signatures

Command Central uses the following digital signature algorithms in order of priority:

  • ecdsa-sha2-nistp256-cert-v01@openssh.com
  • ecdsa-sha2-nistp384-cert-v01@openssh.com
  • ecdsa-sha2-nistp521-cert-v01@openssh.com
  • ssh-ed25519-cert-v01@openssh.com
  • rsa-sha2-512-cert-v01@openssh.com
  • rsa-sha2-256-cert-v01@openssh.com
  • ecdsa-sha2-nistp256
  • ecdsa-sha2-nistp384
  • ecdsa-sha2-nistp521
  • ssh-ed25519
  • sk-ecdsa-sha2-nistp256@openssh.com
  • sk-ssh-ed25519@openssh.com
  • rsa-sha2-512
  • rsa-sha2-256
  • ssh-rsa