---
title: SSH Proxy Encryption and Key Exchange Algorithms
slug: kronpam-reference-guide-3-9-0/ssh-proxy-encryption-and-key-exchange-algorithms
description: Learn how to configure the SSH Proxy and enable/disable key exchange and authentication algorithms in this document. Discover how to set parameters in the nsso.properties file by establishing an SSH connection to the Kron PAM server. Find a comprehensive 
docTags: 
createdAt: 2022-07-27T13:38:40.000Z
---

SSH or secure shell provides a mechanism to establish a cryptographically secured connection between two parties, authenticating each side to the other, and passing commands and output back and forth. To secure the transmission of information, SSH employs several types of data manipulation techniques at various points in the transaction.


System admins can configure the SSH Proxy to enable or disable key exchange and authentication algorithms used between the user and the SSH Proxy.


To configure the SSH Proxy for available key exchange and authentication algorithms:

1. Establish an SSH connection to the Kron PAM server
2. Set the required parameters in **/pam/ssh/conf/nsso.properties** with the commands below. Multiple values can be used when separated with a comma “,”.
   `cd /pam/ssh/conf/
   `****
   `vi nsso.properties`
3. Add/edit the following parameters with the vi editor.


All algorithms supported by SSH Proxy both on the server and client side are shown in the table below.


By default, only the algorithms considered secure should have been enabled at the time of installation. Therefore, we recommend proceeding with caution when considering changes to these nsso.properties parameters.

| **Server Parameter**              | **Available Values**                                                                                                                                                                      |
| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| nsso.server.kex.algorithms        | diffie-hellman-group-exchange-sha256, ecdh-sha2-nistp256, diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, diffie-hellman-group14-sha256, ecdh-sha2-nistp521, ecdh-sha2-nistp384  |
| nsso.server.host.key.algorithms   | ssh-dss,ssh-dsa,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521                                                                           |
| nsso.server.encryption.algorithms | aes192-cbc,aes128-ctr,aes128-cbc,blowfish-cbc,3des-cbc,aes256-cbc,aes192-ctr,aes256-ctr                                                                                                   |
| nsso.server.mac.algorithms        | hmac-md5-96,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-512,hmac-sha1-etm\@openssh.com,hmac-sha2-256,hmac-sha2-256-etm\@openssh.com,hmac-sha2-512-etm\@openssh.com                          |



| **Client Parameter**              | **Available Values**                                                                                                                                                                                                         |
| --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| nsso.client.kex.algorithms        | diffie-hellman-group-exchange-sha256, ecdh-sha2-nistp256, diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, diffie-hellman-group14-sha256, ecdh-sha2-nistp521, ecdh-sha2-nistp384, diffie-hellman-group-exchange-sha1 |
| nsso.client.host.key.algorithms   | ssh-dss,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519, ssh-ed25519                                                                                               |
| nsso.client.encryption.algorithms | aes192-cbc,aes128-ctr,aes128-cbc,blowfish-cbc,3des-cbc,aes256-cbc,aes192-ctr,aes256-ctr,aes128-gcm\@openssh.com, aes256-gcm\@openssh.com                                                                                     |
| nsso.client.mac.algorithms        | hmac-md5-96,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256,hmac-sha2-512,hmac-sha1-etm\@openssh.com,hmac-sha2-256-etm\@openssh.com,hmac-sha2-512-etm\@openssh.com                                                             |