From 67b14142b278b5793a7b706334c6216a0cefdc64 Mon Sep 17 00:00:00 2001
From: crazydi4mond <255249920+crazydi4mond@users.noreply.github.com>
Date: Thu, 26 Feb 2026 19:05:57 +0100
Subject: [PATCH] fix: add CTR cipher fallbacks for older SSH clients

- Add aes128-gcm, aes256-ctr, aes128-ctr to allowed ciphers
- Fixes compatibility with clients that don't support AEAD ciphers
---
 pkg/sshdconfig/sshdconfig.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/sshdconfig/sshdconfig.go b/pkg/sshdconfig/sshdconfig.go
index b8a1bef..6259f42 100644
--- a/pkg/sshdconfig/sshdconfig.go
+++ b/pkg/sshdconfig/sshdconfig.go
@@ -34,7 +34,7 @@ MaxStartups 50:30:100
 
 # === Crypto Hardening ===
 KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
-Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
 MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
 
 # === General Hardening ===