/cc @hanwen

works as intended. 3DES is deprecated, and the CBC ciphers have weaknesses, so they're disabled by default.

@hanwen - can I allow the CBC cipher using the ssh.ClientConfig options, or does this require forking the package as discussed here? #13776

just try it. it should work.

Ended up finding an example of how to use this from one of the unit tests:
https://gondolaweb.com/doc/src/golang.org/x/crypto/ssh/test/session_test.go

Specifically with how to go about appending a cipher to the existing defaults as in here:

func TestCiphers(t *testing.T) {
	var config ssh.Config
	config.SetDefaults()
	cipherOrder := config.Ciphers
	// These ciphers will not be tested when commented out in cipher.go it will
	// fallback to the next available as per line 292.
	cipherOrder = append(cipherOrder, "aes128-cbc", "3des-cbc")

	for _, ciph := range cipherOrder {
		server := newServer(t)
		defer server.Shutdown()
		conf := clientConfig()
		conf.Ciphers = []string{ciph}
		// Don't fail if sshd doesn't have the cipher.
		conf.Ciphers = append(conf.Ciphers, cipherOrder...)
		conn, err := server.TryDial(conf)
		if err == nil {
			conn.Close()
		} else {
			t.Fatalf("failed for cipher %q", ciph)
		}
	}
}

hm. This doesn't work for me. Is this correct?

// Authentication
config := &ssh.ClientConfig{
	Config: sshconfig,
	User:   "ciscouser",
	//Auth: []ssh.AuthMethod{SSHAgent()},
	//alternatively, you could use a password
	Auth:            []ssh.AuthMethod{ssh.Password("blablabla")},
	HostKeyCallback: ssh.InsecureIgnoreHostKey(),
}

I think I am going to have to use telnet instead of ssh...

Mebus

you're not changing the slice inside sshconfig

What do I have to change?

Mebus

config.ciphers = append(config.ciphers, ...)

It's in there, but the github is formatting it badly:

cipherOrder = append(cipherOrder, "aes128-cbc", "3des-cbc")

Like this?

Mebus

you're not changing config.Ciphers, you're just changing cipherOrder

aaaahh!!! My fault. Working now :-)

sshconfig.Ciphers = append(cipherOrder, "3des-cbc")

Thanks. :-)

Mebus

is there documentation somewhere that lists supported ciphers?