How do I configure SSH key exchange (KEX) algorithms in ProVide?

Key exchange (KEX) algorithms are the methods ProVide’s SFTP (SSH) server uses to securely negotiate a shared encryption key with each connecting client. ProVide’s default KEX algorithms are ECDH-SHA2-CURVE25519, DIFFIE-HELLMAN-GROUP-EXCHANGE-SHA256, and DIFFIE-HELLMAN-GROUP14-SHA1. You can change which algorithms are offered by editing the [SFTP KEX Algorithms] section of the Settings.ini configuration file.

How to change the KEX algorithms #

1. Back up your Settings.ini file first.
2. Stop the ProVide service (changes to Settings.ini are applied on startup).
3. Open Settings.ini and edit the [SFTP KEX Algorithms] section to list the algorithms you want to allow, in order of preference.
4. Save the file and restart the ProVide service.

During each connection, ProVide and the client agree on the first algorithm they both support, so the order and the set you list determine what actually gets used.

Available KEX algorithms #

The following algorithms are available for use in ProVide, listed under [SFTP KEX Algorithms] in Settings.ini:

[SFTP KEX Algorithms]
"DIFFIE-HELLMAN-GROUP14-SHA256"
"DIFFIE-HELLMAN-GROUP15-SHA512"
"DIFFIE-HELLMAN-GROUP16-SHA512"
"DIFFIE-HELLMAN-GROUP17-SHA512"
"DIFFIE-HELLMAN-GROUP18-SHA512"
"DIFFIE-HELLMAN-GROUP-SHA1"
"DIFFIE-HELLMAN-GROUP-EXCHANGE-SHA1"
"DIFFIE-HELLMAN-GROUP14-SHA1"
"DIFFIE-HELLMAN-GROUP-EXCHANGE-SHA256"
"RSA1024-SHA1"
"RSA2048-SHA256"
"ECDH-SHA2-NISTP256"
"ECDH-SHA2-NISTP384"
"ECDH-SHA2-NISTP521"
"ECDH-SHA2-NISTK163"
"ECDH-SHA2-NISTP192"
"ECDH-SHA2-NISTP224"
"ECDH-SHA2-NISTK233"
"ECDH-SHA2-NISTB233"
"ECDH-SHA2-NISTK283"
"ECDH-SHA2-NISTK409"
"ECDH-SHA2-NISTB409"
"ECDH-SHA2-NISTK571"
"ECDH-SHA2-CURVE25519"
"CURVE25519"
"CURVE448"
"GSS-GROUP-EXCHANGE-SHA1"
"GSS-GROUP-SHA1"
"GSS-GROUP14-SHA1"

List only the algorithms you want to allow, keeping your preferred (strongest) options at the top.

Security note #

To harden your server, favour the modern options such as ECDH-SHA2-CURVE25519, CURVE25519, CURVE448, and the SHA-512 Diffie-Hellman groups, and drop the older SHA-1-based entries where your clients allow it. DIFFIE-HELLMAN-GROUP14-SHA1 ships in the defaults for compatibility, but SHA-1 exchanges are weaker than the CURVE25519 and SHA-256/512 options, so remove it if none of your clients need it. Always test with your actual SFTP clients after editing the list: if the server and a client share no common KEX algorithm, that client won’t be able to connect.