topic Re: Problem with ssh decryption after SSH server upgrade in General Topics

Problem with ssh decryption after SSH server upgrade

mariusz_sawczuk — Tue, 10 Dec 2013 19:59:43 GMT

After upgrade ssh server to OpenSSH_6.4p1-hpn14v2, OpenSSL 1.0.0j 10 May 2012 I can't connect to this server when using ssh decryption on Palo Alto.

Before ssh server upgrade, decryption was working correctly and I could connect and decrypt ssh traffic.

When I'm trying to connect from client PC I get response:'Server unexpectly closed network connection'.

I check that Palo Alto is sending this message to the client PC (as an SSH proxy) not the destination SSH server.

I also try to connect from the same client PC with SSH decryption turned off, and I could connect.

I'm using PA-3020 with 5.0.9 PAN-OS.

Re: Problem with ssh decryption after SSH server upgrade

goku123 — Tue, 10 Dec 2013 20:18:51 GMT

Was the server's version < 6.2 before the upgrade ?

Re: Problem with ssh decryption after SSH server upgrade

mariusz_sawczuk — Tue, 10 Dec 2013 22:11:06 GMT

I;m not sure right now, what was previous version but was working correctly.

Re: Problem with ssh decryption after SSH server upgrade

dpalani — Thu, 12 Dec 2013 18:48:46 GMT

Do you have a decyption profile attached to the ssl decypt policy ? What have you configured for unsupported mode checks and failure checks.

Set up a filter and run ssl counters to get more info.

show counter global filter category ssl

Deepak

Re: Problem with ssh decryption after SSH server upgrade

goku123 — Thu, 19 Dec 2013 13:44:53 GMT

Keep an eye out for PAN OS 5.0.10. A fix for an issue with some SSH proxy sessions not working to OpenSSH servers versions > 6.2 is being published through fix # 57612

This fix, when available, may help you.

Re: Problem with ssh decryption after SSH server upgrade

VinceM — Fri, 27 Dec 2013 08:10:07 GMT

Hi,

Look in Rn for version 5.0.10, there is:

57612—SSH sessions to servers running OpenSSH version 6.2 or newer through SSH

Decryption were failing in some instances when the computed Diffie-Hellman key is

4096 bits.

Hope help.

Re: Problem with ssh decryption after SSH server upgrade

mariusz_sawczuk — Wed, 05 Feb 2014 13:34:29 GMT

I've upgraded my PAN device even to PAN-OS 6.0, and still ssh decryption doesn't work properly.

I've tried with and without decryption profiles enabled.