MID Server SSH cryptographic algorithms
The MID Server utilizes SSH clients to perform many discovery actions. During the SSH handshake, both the client and server first determine which algorithms both parties support, then client picks the highest priority algorithm. For the Host Key Algorithm, the client picks highest priority algorithm which both parties support that matches the key type.
|  |
Default supported SSH algorithms by priority
Key Exchange Algorithm
- ecdh-sha2-nistp256
- ecdh-sha2-nistp384
- ecdh-sha2-nistp521
- diffie-hellman-group-exchange-sha256
- diffie-hellman-group14-sha256
- diffie-hellman-group16-sha512
- diffie-hellman-group14-sha1
- diffie-hellman-group1-sha1
- diffie-hellman-group-exchange-sha1
Host Key Algorithm (used for public key signature during authentication)
- ssh-ed25519-cert-v01@openssh.com
- rsa-sha2-512-cert-v01@openssh.com
- rsa-sha2-256-cert-v01@openssh.com
- ssh-ed25519
- ecdsa-sha2-nistp256
- ecdsa-sha2-nistp384
- ecdsa-sha2-nistp521
- rsa-sha2-512
- rsa-sha2-256
- ssh-rsa-cert-v01@openssh.com
- ssh-rsa
- ssh-dss
Cipher Algorithm
- aes128-ctr
- aes192-ctr
- aes256-ctr
- aes128-cbc
- aes192-cbc
- aes256-cbc
MAC Algorithm
- hmac-sha2-256
- hmac-sha1
- hmac-sha2-512
- hmac-sha1-96
- hmac-md5-96
- hmac-md5
Customize the SSH algorithms priority list
The MID Server SSH algorithm priorities can be customized based on security needs. Each algorithm is controlled by one of the following MID Server properties.
Note: Glide Import on the instance uses the default algorithm list. The four MID Server properties do not affect Glide Import because it is not run on the MID server. SNCSSH is used for Glide Import on instance for SFTP and SCP.
Key Exchange algorithms: mid.ssh.algorithms.kex
Host Key algorithms: mid.ssh.algorithms.host_key
Cipher algorithms: mid.ssh.algorithms.cipher
MAC algorithms: mid.ssh.algorithms.mac
The properties accept comma separated lists with operators. The first name in the list is highest priority, last name in list is lowest priority. Adding a comma separated list without any operators replaces the default algorithm list. The following operators are based on the OpenSSH standard syntax and modify the algorithm priority list.
- The + operator appends the comma separated list of algorithms to the default algorithm list.
- The - operator removes the comma separated list of algorithms from the default algorithm list.
- The ^ operator places the comma separated list of algorithms at the front of the default algorithm list.
The MID Server properties using the operators to customize the SSH algorithm lists.
Parent Topic:Securing and encrypting MID Server data
Related topics
MID Server certificate check policies
Encrypt or decrypt MID Server configuration file values
MID Server configuration file security
MID Server authentication credentials and SOAP requests
Enable MID Server mutual authentication
MID Server Azure Key Vault integration
Add SSL certificates for the MID Server
Specify an external TrustStore for the MID Server