Defining SSH cipher rijndael-cbc@lysator.liu.se as
set service ssh ciphers rijndael-cbc@lysator.liu.se
will break the daemon (found here https://github.com/vyos/vyos-1x/pull/4896#pullrequestreview-3571265564 by @natali-rs1985)
Dec 13 20:08:27 systemd[1]: Starting OpenBSD Secure Shell server... Dec 13 20:08:27 ip[5411]: /run/sshd/sshd_config line 53: Bad SSH2 cipher spec 'rijndael-cbc@lysator.liu.se'. Dec 13 20:08:27 systemd[1]: ssh@default.service: Main process exited, code=exited, status=255/EXCEPTION Dec 13 20:08:27 systemd[1]: ssh@default.service: Failed with result 'exit-code'. Dec 13 20:08:27 systemd[1]: Failed to start OpenBSD Secure Shell server. Dec 13 20:08:38 systemd[1]: ssh@default.service: Scheduled restart job, restart counter is at 10. Dec 13 20:08:38 systemd[1]: Stopped OpenBSD Secure Shell server.
According to https://bbs.archlinux.org/viewtopic.php?id=188613 rijndael-cbc@lysator.liu.se was removed in OpenSSH 6.7 https://www.openssh.org/txt/release-6.7
sshd(8): The default set of ciphers and MACs has been altered to remove unsafe algorithms. In particular, CBC ciphers and arcfour* are disabled by default.
The currently supported cipher list in Debian Bookworm (VyOS 1.4 and VyOS 1.5) is:
vyos@vyos:~$ ssh -Q cipher 3des-cbc aes128-cbc aes192-cbc aes256-cbc aes128-ctr aes192-ctr aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com chacha20-poly1305@openssh.com