[Orchestrator] In Aspera Orchestrator, we would like to make sshd more secure by only accepting some predefined Ciphers/MACs/KexAlgorithms.

We would like to be able to controll how a Remote Node-connection in Aspera Orchestrator uses chipers and mac:s for security reasons.

This is what we would like to do and what happens today when we do it. In the end you can see how we would like it to work.

We update the file /etc/sshd_config on the transfer server, by adding the following lines:

KexAlgorithms diffie-hellman-group14-sha256,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group- exchange-sha256

Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com

When we restart sshd on the transfer server, the button for testing the Remote Node Connection in the Orchestrator UI stops working (we use the HSTS-server to watch for incoming files).

On the transfer server, we can see why if we check the /var/log/secure:

Feb 9 14:42:26 stoaspacctransfer01 sshd[49331]: Unable to negotiate with 10.24.117.23 port 47570: no matching MAC found. Their offer: hmac-sha1,hmac-md5,hmac-sha1-96,hmac- md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-96,hmac-sha2-512-96,none [preauth]

So we can see that the orchestrator is offering a set if MACs which are now disabled on the transfer server.

If we instead test the connection as user root from commandline on the orchestrator server, it's still works:

ssh -v -i id_rsa asporc@<transfer-server>

We believe the Orchestrator UI is using a different or non default set of MACs, how can we changes this so it behaves like the commandline?