/commands/ssh-protocol/ssh-q-list-supported-algorithms
ssh -Q: list supported ciphers, kex, MACs and key types
- tool
- SSH protocol
- versions
- OpenSSH 6.3+, OpenSSH 10.x
- os
- linux, macos, windows
ssh -Q QUERY prints the algorithms the local OpenSSH binary supports, one per line, without connecting anywhere: ssh -Q cipher, ssh -Q kex, ssh -Q mac, ssh -Q key (key types) and ssh -Q sig (signature algorithms). It shows what the client can do, including algorithms that are disabled by default. To see what the client will offer to a given host, use ssh -G HOST, which prints the resolved configuration.
Supported vs enabled
echo "supported ciphers include 3des-cbc: $(ssh -Q cipher | grep -cx '3des-cbc')"
echo "enabled by default include 3des-cbc: $(ssh -T -G example.net | grep -i '^ciphers ' | tr ' ,' '\n\n' | grep -cx '3des-cbc')"
echo "enabled by default include aes256-gcm@openssh.com: $(ssh -T -G example.net | grep -i '^ciphers ' | tr ' ,' '\n\n' | grep -cx 'aes256-gcm@openssh.com')"Output
supported ciphers include 3des-cbc: 1 enabled by default include 3des-cbc: 0 enabled by default include aes256-gcm@openssh.com: 1
3des-cbc is compiled in (the first count is 1) but not offered (the second is 0). This is why Their offer: errors can be fixed with +algorithm options: the algorithm exists, it is only switched off.
Queries
| Command | Lists |
|---|---|
| ssh -Q cipher | Symmetric ciphers (Ciphers option) |
| ssh -Q cipher-auth | Ciphers with built-in authentication (AEAD), which ignore the MAC setting |
| ssh -Q mac | Message authentication codes (MACs option) |
| ssh -Q kex | Key exchange algorithms (KexAlgorithms option) |
| ssh -Q key | Public key types, including certificate types |
| ssh -Q key-plain / key-cert | Only plain key types / only certificate types |
| ssh -Q sig | Signature algorithms (HostKeyAlgorithms, PubkeyAcceptedAlgorithms) |
| ssh -Q protocol-version | SSH protocol versions (only 2 in current releases) |
| ssh -Q help | The list of valid query names for this version |
What the client offers to one host
ssh -G myserver | grep -Ei '^(ciphers|macs|kexalgorithms|hostkeyalgorithms) '
ssh -vv myserver 2>&1 | grep -E 'kex: (algorithm|host key|server->client|client->server)'ssh -G applies ~/.ssh/config and command-line -o options for that host name. ssh -vv shows what was actually negotiated with the server in the kex: lines.
On the server
sudo sshd -T | grep -Ei '^(ciphers|macs|kexalgorithms|hostkeyalgorithms) 'sshd -T prints the effective server configuration; together with the client's ssh -G output it shows which side is missing an algorithm. The output of ssh -Q depends on the OpenSSH version and how it was built (for example, post-quantum mlkem768x25519-sha256 key exchange appears from OpenSSH 9.9).