WTI Knowledge Base
SSH Security Modes
WTI units support two SSH Security Levels: Normal and High. These settings control which SSH algorithms are advertised by the unit.
WTI devices provide two SSH Security Level options: Normal and High. Normal mode is intended for greater compatibility with a wider range of SSH clients. High mode provides a more restrictive SSH configuration by limiting the available MAC algorithms and changing the KEX algorithm list/order.
Changing the SSH Security Level
From the WTI command line interface, go to:
/N
22. SSH Access
3. Security Level
Then select either:
Normal High
Example SSH Access submenu:
SSH ACCESS: [Shared]
1. Enable: On
2. Port: 22
3. Security Level: Normal
4. SSH View Port Enable: Off
5. SSH View Port Bidirection: Off
1. Enable: On
2. Port: 22
3. Security Level: Normal
4. SSH View Port Enable: Off
5. SSH View Port Bidirection: Off
Normal vs High Mode Comparison
| Category | Normal Mode | High Mode |
|---|---|---|
| Ciphers | chacha20-poly1305@openssh.com aes128-gcm@openssh.com aes256-gcm@openssh.com aes128-ctr aes192-ctr aes256-ctr |
chacha20-poly1305@openssh.com aes128-gcm@openssh.com aes256-gcm@openssh.com aes128-ctr aes192-ctr aes256-ctr |
| MACs | umac-64-etm@openssh.com umac-128-etm@openssh.com hmac-sha2-256-etm@openssh.com hmac-sha2-512-etm@openssh.com hmac-sha1-etm@openssh.com umac-64@openssh.com umac-128@openssh.com hmac-sha2-256 hmac-sha2-512 hmac-sha1 |
umac-128-etm@openssh.com hmac-sha2-256-etm@openssh.com hmac-sha2-512-etm@openssh.com |
| KEX Algorithms | mlkem768x25519-sha256 sntrup761x25519-sha512 sntrup761x25519-sha512@openssh.com curve25519-sha256 curve25519-sha256@libssh.org ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 |
diffie-hellman-group18-sha512 diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 curve25519-sha256@libssh.org curve25519-sha256 diffie-hellman-group-exchange-sha256 mlkem768x25519-sha256 sntrup761x25519-sha512 sntrup761x25519-sha512@openssh.com |
| Host Key Algorithms | rsa-sha2-512 rsa-sha2-256 ssh-ed25519 |
rsa-sha2-512 rsa-sha2-256 ssh-ed25519 |
Notes
- SSH key size is 2048.
- Actual negotiated algorithms may vary depending on the SSH client and the algorithms supported by both the client and the WTI device.
-
chacha20-poly1305@openssh.comis an authenticated encryption cipher. When selected, the MAC is implicit. - High mode restricts MAC algorithms and changes the KEX algorithm list/order, but it does not remove ChaCha20-Poly1305 from the advertised cipher list.