Changing ssh ciphers on EC2 ubuntu

I'm running ubuntu on an Amazon EC2 server - I need to lock down the ssh ciphers for pci compliance. I have tried editing the /etc/ssh/sshd_config, with these lines:

Ciphers aes256-ctr,aes192-ctr,aes128-ctr
KexAlgorithms diffie-hellman-group-exchange-sha256
MACs hmac-sha2-512,hmac-sha2-256,hmac-ripemd160

and restarted the server. However, this command:

ssh -Q cipher localhost

still lists a full range of ciphers that I no longer want. Is there some configuration I'm missing?

ssh version is OpenSSH_6.6.1p1 Ubuntu-2ubuntu2, OpenSSL 1.0.1f 6 Jan 2014
Linux is: Linux ip-172-31-34-22 3.13.0-36-generic #63-Ubuntu SMP Wed Sep 3 21:30:07 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

Thanks for any advice.

1 Answer

ssh -Q cipher reports the ciphers supported by the ssh client, not the server.

One way to verify that you have successfully removed the cipher foo from the server configuration is to explicitly use it for your connection:

ssh -oCiphers=foo localhost

relevant excerpt from ssh.c option processing:

 case 'Q': cp = NULL; if (strcmp(optarg, "cipher") == 0) cp = cipher_alg_list('\n', 0); /* deleted other options... */ if (cp == NULL) fatal("Unsupported query \"%s\"", optarg); printf("%s\n", cp); free(cp); exit(0); break;