Re: [ssh] Host key sync - "global-requests-ok" extension

You're focusing on an outdated aspect of the spec instead of widely 
known best practice.

CBC algorithms are known to have security problems in the way they are 
used in SSH. They haven't been recommended for use in years.

If we ship the SSH Server with CBC algorithms enabled, we get support 
cases from users failing security scans.


On 2018-12-19 04:24, Peter Gutmann wrote:
> denis bider <[email protected]> writes:
>
>>> Do you have a test server up that we can run clients against?
>> We do now:
>>
>> ssh -P 10999 [email protected]
> You know how I complained about OpenSSH not supporting any of the MTI
> symmetric ciphers in the SSH spec?  Well...
>
> Error: No algorithm compatible with the remote system's selection was found: '[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr'.
>
> Peter.
>
>