topic Re: SSH weak algorithm supported in Firewall and Security Management

SSH weak algorithm supported

LostBoY — Fri, 29 Jan 2021 12:55:03 GMT

a Vulnerability "SSH weak Algorithms supported" has been reported in R80.10 Gateways.. What is the procedure to resolve this vulnerability ?

are some modifications required in sshd conf file for this ?

Thanks

Re: SSH weak algorithm supported

Chris_Atkinson — Fri, 29 Jan 2021 13:42:22 GMT

Start with reviewing sk106031 depending on the specific finding.

Re: SSH weak algorithm supported

PhoneBoy — Fri, 29 Jan 2021 17:16:50 GMT

You can adjust some of the algorithms offered by modifying the sshd configuration.
However, the version of OpenSSH we use prior to R80.40 is old and does not offer some of the currently recommended algorithms.
Given that R80.10 is End of Support in a few months, it’s highly recommended you upgrade.

Re: SSH weak algorithm supported

LostBoY — Wed, 03 Feb 2021 14:28:07 GMT

Yes ..we have an upgrade planned in March for this.

Can you please point out the config i need to modify in sshd file

Re: SSH weak algorithm supported

the_rock — Wed, 03 Feb 2021 14:36:33 GMT

Hi,

Its right in the sk itself:

Add the following 2 lines to the /etc/ssh/ssh_config and /etc/ssh/sshd_config files:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr

MACs hmac-sha1

Important: There should be no spaces between ciphers/MACs and commas.
Remove previous "Ciphers/MACs" lines if they currently exist in the above files.
Restart the SSH server using the service sshd restart command.

Re: SSH weak algorithm supported

LostBoY — Wed, 03 Feb 2021 14:54:57 GMT

Thanks for the reply..

i was looking in the sshd and ssh config files but i dont see any enabled CIPHERS there.

in the ssh config there is a line ciphers aes-.. blowfish.. and so on but it is hashed out .. this line is not present in sshd config file.

So i am a bit confused here.. why the vulnerability is being detected if it is hashed out ? or does no entry in the file related to default ciphers ?

Re: SSH weak algorithm supported

the_rock — Wed, 03 Feb 2021 14:56:31 GMT

Send me the file privately and I can compare it to one from fresh gateway.

Andy

Re: SSH weak algorithm supported

Bob_Zimmerman — Wed, 03 Feb 2021 15:10:49 GMT

The OpenBSD developers (and OpenSSH is an OpenBSD project) include default values for most configurable items. These default values don't need anything in the config file to work, but they include them in the config file anyway as a valid config line which would result in the same behavior as the default, commented out.

You can either remove the "# " at the start of the line and edit it to your requirements (the defaults for a given OpenSSH version are easy enough to find online), or you can add a new line in the file meeting your requirements.