---
title: Advanced: SSH Configuration
slug: epmm/system-manager-guide/advanced-ssh-configuration
createdAt: 2026-10-06T07:58:36.561Z
---

Use <font color="#323232">Security &gt; Advanced &gt; SSH Configuration </font>to configure ciphers, key exchange algorithms and hmacs. The System Manager portal allows you to upload the public keys then enable or disable public key and password authentications. By default, both **Public Key Authentication** and **Password Authentication** options are enabled and SSH configurations are applied to both SSH client and server. Configurations persist after a Backup and Restore procedure is completed.

When enabled, SSH public key authentication is attempted first. A valid public key for an authorized administrator account must be uploaded. Otherwise, password authentication is used.

:::hint{type="info"}
The public key authentication is specified by the administrator and is valid only for the user uploading the key. For example, if \<admin> is the user uploading the key, then ssh for admin@\<ip> will be successful.
:::

The default (non-FIPS) SSH, FIPS SSH, and CC (Common Criteria) SSH configurations have different sets of <font color="#323232">ciphers, key exchange algorithms, and hash-based message authentication code (HMAC)</font> options, as described in [Default SSH configuration](docId:3jX0o1dTQ0gFyrEBMpBsU), [FIPS SSH configuration](docId:3jX0o1dTQ0gFyrEBMpBsU), and [CC SSH configurations](docId:3jX0o1dTQ0gFyrEBMpBsU).

:::hint{type="info"}
You cannot ssh to a cluster, you must instead ssh to a specific instance.
:::

## Default SSH configuration

The following table lists the available options for the default SSH configuration:

Table: Default SSH configuration options

| Configuration           | Available                                                            | Selected                                                                                                                        |
| ----------------------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| Key Exchange Algorithms | - ecdh-sha2-nistp256                                                 | - curve25519-sha256\@libssh.org<br />- ecdh-sha2-nistp384<br />- ecdh-sha2-nistp521<br />- diffie-hellman-group-exchange-sha256 |
| Cipher                  | - aes256-cbc<br />- aes128-cbc<br />- chacha20-poly1305\@openssh.com | - aes256-gcm\@openssh.com<br />- aes128-gcm\@openssh.com<br />- aes256-ctr<br />- aes128-ctr                                    |
| HMAC                    |                                                                      | - hmac-sha2-512<br />- hmac-sha2-256                                                                                            |

## FIPS SSH configuration

The following table lists the available options for the default FIPS SSH configuration:

Table: FIPS SSH configuration options

| Configuration           | Available | Selected                                                           |
| ----------------------- | --------- | ------------------------------------------------------------------ |
| Cipher                  |           | - aes256-gcm<br />- aes128-gcm<br />- aes256-ctr<br />- aes128-ctr |
| Key Exchange Algorithms |           | - diffie-hellman-group-exchange-sha256                             |
| HMAC                    |           | - hmac-sha2-512<br />- hmac-sha2-256                               |

## CC SSH configurations

The following table lists the available options for the default Common Criteria (CC) SSH configuration:

Table: CC SSH configuration options

| Configuration           | Available                                                          | Selected                               |
| ----------------------- | ------------------------------------------------------------------ | -------------------------------------- |
| Cipher                  | - aes256-gcm<br />- aes128-gcm<br />- aes256-ctr<br />- aes128-ctr | - aes256-cbc<br />- aes128-cbc         |
| Key Exchange Algorithms | - diffie-hellman-group-exchange-sha256                             | - diffie-hellman-group-exchange-sha256 |
| HMAC                    |                                                                    | - hmac-sha2-512<br />- hmac-sha2-256   |