topic RE: Securing SSH2 daemon on XOS 15.6.1.4 - disable MD5 or 96-bit MAC algorithms in ExtremeSwitching (EXOS/Switch Engine)

Securing SSH2 daemon on XOS 15.6.1.4 - disable MD5 or 96-bit MAC algorithms

Zsolt_Babindai — Mon, 22 Jun 2015 14:24:00 GMT

Hi,
our security team is reported that XOS sshd is using either MD5 or 96-bit MAC algorithms, which are considered weak. Is there any way to configure the MAC algorithm which is used by SSH daemon on XOS? Our devices are (x670/440).

RE: Securing SSH2 daemon on XOS 15.6.1.4 - disable MD5 or 96-bit MAC algorithms

Ken_Thomas — Mon, 22 Jun 2015 17:49:00 GMT

Zsot, I have reached to some of the GTAC engineers who should be able to help shed some light on your question

RE: Securing SSH2 daemon on XOS 15.6.1.4 - disable MD5 or 96-bit MAC algorithms

Zsolt_Babindai — Mon, 22 Jun 2015 18:23:00 GMT

Thanks, I'm looking forward to getting some useful info.

RE: Securing SSH2 daemon on XOS 15.6.1.4 - disable MD5 or 96-bit MAC algorithms

Zsolt_Babindai — Wed, 24 Jun 2015 13:43:00 GMT

Any news?

RE: Securing SSH2 daemon on XOS 15.6.1.4 - disable MD5 or 96-bit MAC algorithms

Colatuno__Joe — Wed, 24 Jun 2015 19:05:00 GMT

Hey Zsot,

Current EXOS SSH implementation is based off SSH Secure Shell Toolkit? version 4.1.2.

16.2 SSH code will move from the Toolkit to OpenSSH 6.5p1 which will address these algorithm vulnerabilities

Currently roadmap for 16.2 release is looking like December. I see no plans to have this implemented in earlier software versions unfortunately.

RE: Securing SSH2 daemon on XOS 15.6.1.4 - disable MD5 or 96-bit MAC algorithms

Ken_Thomas — Fri, 26 Jun 2015 18:44:00 GMT

Zsot, let us know if this answers your question or if you have any follow up questions

RE: Securing SSH2 daemon on XOS 15.6.1.4 - disable MD5 or 96-bit MAC algorithms

Zsolt_Babindai — Tue, 30 Jun 2015 16:54:00 GMT

Hi, sorry I was out of office for some days and just returned. Thank you very much for your answer, this is enough for me. We will upgrade to 16.2 when it will be available.

RE: Securing SSH2 daemon on XOS 15.6.1.4 - disable MD5 or 96-bit MAC algorithms

Chad_Smith1 — Mon, 06 Jul 2015 23:49:00 GMT

Zsolt,

It looks like the SSH Server upgrade may not make it into EXOS 16.2. It seems it is currently scoped for 16.3.

Also, I have created a GTACKnowledge article for future reference: Is there any way to configure the MAC algorithm which is used by the SSH daemon in EXOS?