topic Re: SSH protocol uses Weak key exchange algorithms in PA 500 for PAN OS 8.1.14 in Advanced Threat Prevention Discussions

SSH protocol uses Weak key exchange algorithms in PA 500 for PAN OS 8.1.14

Shashihm — Tue, 12 May 2020 11:10:51 GMT

Hi Team ,

PA 500 with 8.1.14 (latest OS ) is having the Vulnerability SSH protocol uses Weak key exchange algorithms. I understand we can change algorithm values with set deviceconfig system ssh kex to stronger algorithm post 9.0 unfortunately PA 500 do not have 9.0 release in software download.

So how do we close this one , is there any alternative way we can change Kex values , or else we need to compromise with this Vulnerability.

Re: SSH protocol uses Weak key exchange algorithms in PA 500 for PAN OS 8.

reaper — Tue, 12 May 2020 11:15:21 GMT

If you do not expose your management interface to an untrusted network (make it accessible inside MGMT network, set an ACL,..) you will be able to mitigate most exposure

If you must make the interface available, ensure connections need to traverse the firewall so you can apply security profiles to the connection

Re: SSH protocol uses Weak key exchange algorithms in PA 500 for PAN OS 8.

Shashihm — Tue, 12 May 2020 14:17:23 GMT

TAC Engineer is suggesting to change the Firewall mode into FIPS-CC. Is it viable to change the Firewalls which are in production to FIPS-CC to mitigate this Vulnerability.

Re: SSH protocol uses Weak key exchange algorithms in PA 500 for PAN OS 8.

OtakarKlier — Tue, 12 May 2020 18:39:39 GMT

Hello,

You might want to read up on what is truly disabled via FIPS mode. Also here is an article on disabling weak ciphers.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMNPCA4

Cheers!

Re: SSH protocol uses Weak key exchange algorithms in PA 500 for PAN OS 8.

mivaldi — Tue, 12 May 2020 23:51:53 GMT

Try this:

# configure
# delete deviceconfig system ssh
# set deviceconfig system ssh ciphers mgmt aes256-ctr
# set deviceconfig system ssh default-hostkey mgmt key-type ECDSA 256
# set deviceconfig system ssh regenerate-hostkeys mgmt key-type ECDSA key-length 256
# set deviceconfig system ssh session-rekey mgmt interval 3600
# set deviceconfig system ssh mac mgmt hmac-sha2-256
# commit
# exit
> set ssh service-restart mgmt

Re: SSH protocol uses Weak key exchange algorithms in PA 500 for PAN OS 8.1.14

GlobalAxis — Sat, 05 Nov 2022 05:16:59 GMT

Dear all ,

Can I have GUI tips for fixing the same

Re: SSH protocol uses Weak key exchange algorithms in PA 500 for PAN OS 8.1.14

mivaldi — Tue, 08 Nov 2022 23:02:58 GMT

@GlobalAxis what PAN-OS version are you running?