Sane security defaults for SSH clients. Disables everything old and nasty.

config-security

# vim: ft=sshconfig
# Sane security defaults for SSH clients. Disables everything old and nasty.
# Unfortunately, SSH appears to provide no way to *exclude* old protocols,
# so we have a list of known-secure key exchange algorithms, symmetric ciphers,
# and message authentication codes.
# Config taken from [https://stribika.github.io/2015/01/04/secure-secure-shell.html]

Host *
  KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256
  Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
  MACs [email protected],[email protected]

# Unfortunately, Github supports neither authenticated encryption,
# nor encrypt-then-MAC.
Host github.com
  MACs [email protected],[email protected],hmac-sha2-512

It's just the bits of client config spread throughout the blog post, collected into one handy config file.