Thanks for the information. Sadly some of the old things do use DSA keys so we are stuck on 0.10.x for now. The trouble is that there are documented CVEs and our security teams are pushing for all CVEs addressed ... so we need to move to a later release, but we cannot do so without breaking support for legacy things.
Adam ________________________________ From: Jakub Jelen <[email protected]> Sent: Wednesday, September 23, 2026 10:13 AM To: [email protected] <[email protected]> Subject: Re: Enabling all ciphers, HMACs, keyex & host key algos for ssh connections Hi Adam, There are algorithms that are disabled by default (mostly SHA-1 based) and there are algorithms that were removed already (DSA). If you are up to getting DSA, you would have to fetch some older libssh version ( < 0. 11. 0 for DSA).  Hi Adam, There are algorithms that are disabled by default (mostly SHA-1 based) and there are algorithms that were removed already (DSA). If you are up to getting DSA, you would have to fetch some older libssh version ( < 0.11.0 for DSA). For algorithms not enabled by default, we do in interoperability test programs (ping and pkd), which are enabling all supported algorithms from hostkey algorithms, key exchange, ciphers and macs: https://gitlab.com/libssh/libssh-mirror/-/blob/master/tests/ssh_ping.c?ref_type=heads#L75<https://urldefense.com/v3/__https://gitlab.com/libssh/libssh-mirror/-/blob/master/tests/ssh_ping.c?ref_type=heads*L75__;Iw!!OmxWZm2fcg!XH1j0aXCHQYqRaaWIQIYKvRJx86CP-Hf7-lr5s91KVpGjs2Wdq42suWDCsmUhvJn3Ekp7F_kzsZBTOdFcV1U$> https://gitlab.com/libssh/libssh-mirror/-/blob/master/tests/pkd/pkd_daemon.c#L299<https://urldefense.com/v3/__https://gitlab.com/libssh/libssh-mirror/-/blob/master/tests/pkd/pkd_daemon.c*L299__;Iw!!OmxWZm2fcg!XH1j0aXCHQYqRaaWIQIYKvRJx86CP-Hf7-lr5s91KVpGjs2Wdq42suWDCsmUhvJn3Ekp7F_kzsZBTCQGR8GJ$> This API (ssh_get_supported_methods) is available since libssh 0.12.0. Hope it helps. Jakub On Tue, Sep 22, 2026 at 2:53 PM Kerrison, Adam <[email protected]<mailto:[email protected]>> wrote: Slightly mad request but is it possible to enable all ciphers, HMACs, keyex & host key algos for an ssh connection? Yes I know its insecure but I need to ensure that I can connect to a target system no matter how old and legacy its ssh set up - we have targets which are potential 10 or more years old so they only support poor crypto by modern standards. I've tried to do this before by trying to list all the supported options (I even forked the code to expose a way to query those options) but it was complex and time consuming and I just ran out of cycles to get it all done. Really what I am looking for is a way to "enable everything" Adam PS. Yes those old legacy things should be upgraded but I am not in position to make that happen. Some are embedded things which are seriously expensive to replace just because the controller is potentially "insecure"
