Please utilize the system's crypto policy for enabled by default ciphers: https://fedoraproject.org/wiki/Packaging:CryptoPolicies As it is now libssh's configuration is provided per application using ssh_options_parse_config() making the administrator/user responsible any enabled ciphers, and in case of software upgrades to keep up-to-date the list of available ciphers allowed, parameters etc. It would align more to the fedora system-wide policy directions if the library could apply some default settings based on the system policy when the user doesn't override/set a config file. For example fallback into reading a global configuration file in case the user doesn't have one (e.g., /etc/crypto-policies/back-ends/openssh.config).
It seems the code already falls back to read /etc/ssh/ssh_config when no filename is set, or no user config exists. However, in Fedora we use Include directives on the configuration file, which in turn include /etc/ssh/ssh_config.d/05-redhat.conf and this includes /etc/crypto-policies/back-ends/openssh.config. So this is pretty much an RFE to support recursive including of files.
Created attachment 1317699 [details] Support include files