Is the version of OpenSSH or the version of OpenSSL (or a combination of the two) that is installed on a given system what determines which Ciphers, KexAlgorithms, and MACs are available to be configured for use?

Background: We have a legacy process that is using SSH/SFTP to exchange data between an outside organization and ours. The outside organization is going to begin enforcing the use of stronger crytographic algorithms. No surprise, the instance of either OpenSSH or OpenSSL installed on our end is not up to snuff.

Trying to figure out where I would need to look to determine what minimum level I need to make this work in the short term. What version of which package would carry a given algorithm?

  • OpenSSH can be built with OpenSSL support or without. Check if your version depends on libssl or similar, which would indicate it's built with OpenSSL. Jan 10, 2019 at 18:50
  • i see libcrypto, but not libssl specifically
    – Erik
    Jan 10, 2019 at 20:01
  • 1
    @Erik libcrypto is the relevant library from OpenSSL that OpenSSH links against. It just uses the cryptographic functions, not the TLS implementation. Jan 10, 2019 at 20:02
  • 1
    @Erik - That depends on how OpenSSL was built.
    – Ramhound
    Jan 11, 2019 at 12:46
  • 1
    Any specific reason to not just use the currently available latest version?
    – user1686
    Jan 11, 2019 at 12:47


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.