Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

After upgrading to Debian 8.0, my PhpDesigner could not connect over sftp.
Client reported:
Server does not support diffie-hellman-group1-sha1 for keyexchange.

Server reported: (breaks added)
fatal: no matching cipher found:
client blowfish-cbc,cast128-cbc,aes128-cbc,3des-cbc
server aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
[preauth]

Reports suggested adding the needed ciphers, so I wanted to get the current
options, and adding the needed.

sshd -T looked like the option to get the current options:
man sshd:
   -T      Extended test mode.  Check the validity of the configuration file,
  output the effective configuration to stdout and then exit.


But
 sshd -T|grep kex
kexalgorithms
diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org

shows the algoritm client complains about

 sshd -T|grep ciphers
ciphers
3des-cbc,blowfish-cbc,cast128-cbc,arcfour,arcfour128,arcfour256,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com

shows the ciphers, server complains about

 sshd -T|grep kex >> /etc/ssh/sshd_config
 sshd -T|grep ciphers >> /etc/ssh/sshd_config
 service ssh restart

makes my sftp client connect.

It appears that -T does not show the effective (current) options, but the
available options.

*** End of the template - remove these template lines ***

Dear Maintainer,

The bug appears only if the Ciphers directive is missing and implied from program defaults:
(i'm guessing that -T runs prior to proper full initialization of 'sshd')

    $ grep -i ciphers /etc/ssh/sshd_config
    $
    $ sudo /usr/sbin/sshd -T | grep -i ciphers
    ciphers 3des-cbc,blowfish-cbc,cast128-cbc,arcfour,arcfour128,arcfour256,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
-or-
    $ sudo /usr/sbin/sshd -f /dev/null -T | grep -i ciphers
    ciphers 3des-cbc,blowfish-cbc,cast128-cbc,arcfour,arcfour128,arcfour256,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com

If we explicitly specify the manpage defaults, '-T' functions as expected:

    $ echo 'Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com' | sudo /usr/sbin/sshd -T -f /dev/stdin | grep ciphers
    ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com