topic Re: How do I remove KEX diffie-hellman-group1-sha1 from SSH on PAN-OS 8.1? in General Topics

How do I remove KEX diffie-hellman-group1-sha1 from SSH on PAN-OS 8.1?

pdwilson — Fri, 22 Jul 2022 03:33:31 GMT

Our vulnerability scanner has detected a weak KEX algorithm (diffie-hellman-group1-sha1) on our firewall. Is there a persistent way to disable the weak KEX algorithm?

I found this article (below), but it says every time the firewall reboots the weak algorithm becomes enabled again.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PN5bCAG

Re: How do I remove KEX diffie-hellman-group1-sha1 from SSH on PAN-OS 8.1?

Metgatz — Tue, 26 Jul 2022 07:05:36 GMT

@pdwilson

Hello friend, recently I had to apply 9.1.x and after the reboot the weak algorithms remained disabled.

That you comment most likely only applied to 8.x.x and 8.1.x.

Regards

Re: How do I remove KEX diffie-hellman-group1-sha1 from SSH on PAN-OS 8.1?

pdwilson — Thu, 28 Jul 2022 00:47:23 GMT

Thanks for the reply. I agree, Unfortunately the latest version of PAN-OS compatible with the firewall in question is 8.1.x, so upgrading to 9.1.x is not an option for me. I suppose I will have to deal with this until the HW is EOL and is replaced. I was just hoping there was "permanent" setting for 8.1.x.