0

I have set the cipher algorithms for ssh on my server to just chacha20-poly1305@openssh.com, aes256-gcm@openssh.com and aes128-gcm@openssh.com

Now my IntelliJ fails with this error:

failed: unable to reach a settlement: [aes128-cbc, aes128-ctr, aes192-cbc, aes192-ctr, aes256-cbc, aes256-ctr, blowfish-cbc, blowfish-ctr, cast128-cbc, cast128-ctr, idea-cbc, idea-ctr, serpent128-cbc, serpent128-ctr, serpent192-cbc, serpent192-ctr, serpent256-cbc, serpent256-ctr, 3des-cbc, 3des-ctr, twofish128-cbc, twofish128-ctr, twofish192-cbc, twofish192-ctr, twofish256-cbc, twofish256-ctr, twofish-cbc, arcfour, arcfour128, arcfour256] and [chacha20-poly1305@openssh.com, aes256-gcm@openssh.com, aes128-gcm@openssh.com]

So I will have to enable one of the ciphers that IntelliJ uses, but how do I find out which of this list is the least insecure?

aes128-cbc, aes128-ctr, aes192-cbc, aes192-ctr, aes256-cbc, aes256-ctr, blowfish-cbc, blowfish-ctr, cast128-cbc, cast128-ctr, idea-cbc, idea-ctr, serpent128-cbc, serpent128-ctr, serpent192-cbc, serpent192-ctr, serpent256-cbc, serpent256-ctr, 3des-cbc, 3des-ctr, twofish128-cbc, twofish128-ctr, twofish192-cbc, twofish192-ctr, twofish256-cbc, twofish256-ctr, twofish-cbc, arcfour, arcfour128, arcfour256

Update: I guess, that would be aes256-ctr, but that is just a guess

1 Answer 1

2

Yes, aes256-ctr is the right cipher to choose from those available to you.

Since it's not an AEAD, you need to choose a MAC. You should choose an '-etm' one if you can, and among those I'd choose the fastest.

Also make sure you have a strong key exchange (in descending order of preference: curve25519, ecdh-sha2-nistp256, diffie-hellman-group18/16/14, not something with sha1) and strong host key (in descending order of preference: ed25519, ecdsa with nistp256, RSA, nothing with sha1 or DSS).

If IntelliJ doesn't support a secure ssh configuration, complain to JetBrains.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.