sshd fails to start when Ciphers parameter is present

[Positron]

I've been attempting to harden the sshd config on my new FreeNAS setup (I know FreeNAS is supposed to rely on network security, but I don't trust my consumer grade router as much as I trust sshd), and one of the parameters I've tried to set, namely:

Ciphers aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
​

causes the daemon to fail to start, silently from the shell and with the message "The service could not be started." from the GUI. The ciphers specified are both supported as of OpenSSH 6.4, and the parameter and syntax are correct according to FreeBSD's sshd_config documentation. Adding the parameter through the WebGUI and through modifying the script that generates sshd_config manually and rebooting both fail in the same way.

Also, how can I go about limiting the Host Keys that sshd uses, and regenerating the RSA key with a 4096 bit size, given that the keys aren't stored permanently in /etc? I don't particularly feel like letting my system support 1024 bit DSA, and while I'm at it would like to up the RSA key strength.

 

[dlavigne]

causes the daemon to fail to start, silently from the shell and with the message "The service could not be started." from the GUI.

Anything in /var/log/messages?

 

[Positron]

Yes (didn't check before, wasn't sure where to look :p), there was a "Bad SSH2 cipher" error; I noticed a typo and corrected it, but it still gives me the error for the aes***-gcm ciphers, even when I try them alone, and I'm pretty sure there's no more typos (tried pasting them into Find on the FreeBSD online sshd_config man page):

freenas notifier: /etc/ssh/sshd_config line 16: Bad SSH2 cipher spec 'aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com'.​

freenas notifier: /etc/ssh/sshd_config line 16: Bad SSH2 cipher spec 'aes128-gcm@openssh.com'.​

freenas notifier: /etc/ssh/sshd_config line 16: Bad SSH2 cipher spec 'aes256-gcm@openssh.com'.​

Funnily enough, works fine with only the (newer) chacha20-poly1305 cipher...

freenas notifier: Performing sanity check on sshd configuration.
freenas notifier: Starting sshd.
​

Not sure why that is. I can live with the one cipher though if there isn't a solution for now. Thanks!

Any ideas about changing the host keys?

 

[dlavigne]

Any ideas about changing the host keys?

Create a feature request at bugs.freenas.org requesting a larger bit size. If you do, post the issue number here.