topic Re: When will PAN-OS start supporting modern SSH ciphers? in General Topics

When will PAN-OS start supporting modern SSH ciphers?

Han.Valk — Sun, 05 Jan 2025 11:55:16 GMT

I'm running PAN-OS 11.1 and OpenSSH 9.X.

I had to tune my sshd_config to support really ancient stuff like aesXXX-ctr and hmac-sha1 just to allow for SSH decrytion...

Please Palo Alto update the supported ciphers and MACs!!

Re: When will PAN-OS start supporting modern SSH ciphers?

JayGolf — Thu, 02 Jan 2025 23:29:45 GMT

Hi @Han.Valk ,

Which ciphers were you hoping to use? I can check if there are any open feature requests out. If not, best bet is to reach out to your SE and share your requirements to create a FR.

Re: When will PAN-OS start supporting modern SSH ciphers?

Han.Valk — Tue, 07 Jan 2025 07:23:59 GMT

For instance addition of the following:

Host Key Algorithms:
- ecdsa-sha2-nistp256
- ecdsa-sha2-nistp384
- ecdsa-sha2-nistp521
Encryption (ciphers):
- aes128-gcm
- aes256-gcm
- chacha20-poly1305
Message Authentication (MACs):
- hmac-sha2-256
- hmac-sha2-512

And then of course modern key exchange algorithms, b.t.w. the current for SSH Proxy supported ones aren't even mentioned in the Palo Alto documentation:

ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521

Regards,

Han.