ssh server cipher set

On the SSH Server (/etc/ssh/sshd_config):                       Copy
Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com

• The server restricts which ciphers it will accept.
• The first listed cipher is preferred.

On the SSH Client (~/.ssh/config or /etc/ssh/ssh_config):       Copy
Host remote-server
    Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com

• The client requests its preferred ciphers.
• The first cipher in the list is preferred by the client.

• Both Client & Server Must Agree on a Cipher – If a cipher is not in both lists, the connection fails.
• Server Can Enforce Restrictions – If the server only allows chacha20-poly1305, but the client requests aes128-ctr, the client must use the server's allowed cipher.
• Client Preference Wins if Multiple Ciphers Are Allowed – If the server allows aes256-ctr,aes128-ctr and the client requests aes128-ctr first, then aes128-ctr will be used.