Is the version of OpenSSH or the version of OpenSSL (or a combination of the two) that is installed on a given system what determines which Ciphers, KexAlgorithms, and MACs are available to be configured for use?

Background: We have a legacy process that is using SSH/SFTP to exchange data between an outside organization and ours. The outside organization is going to begin enforcing the use of stronger crytographic algorithms. No surprise, the instance of either OpenSSH or OpenSSL installed on our end is not up to snuff.

Trying to figure out where I would need to look to determine what minimum level I need to make this work in the short term. What version of which package would carry a given algorithm?

  • OpenSSH can be built with OpenSSL support or without. Check if your version depends on libssl or similar, which would indicate it's built with OpenSSL. – garethTheRed Jan 10 at 18:50
  • i see libcrypto, but not libssl specifically – Erik Jan 10 at 20:01
  • 1
    @Erik libcrypto is the relevant library from OpenSSL that OpenSSH links against. It just uses the cryptographic functions, not the TLS implementation. – Austin Hemmelgarn Jan 10 at 20:02
  • 1
    @Erik - That depends on how OpenSSL was built. – Ramhound Jan 11 at 12:46
  • 1
    Any specific reason to not just use the currently available latest version? – grawity Jan 11 at 12:47

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.