topic Re: How to disable SSH weak algorithm supported in General Topics

How to disable SSH weak algorithm supported

cnarvasa — Thu, 08 Mar 2018 19:52:12 GMT

We used Nessus to run security scan on the PA-5220 we are trying out and it came back with the following medium vulnerability:

https://www.tenable.com/plugins/nessus/90317

The remote SSH server is configured to allow weak encryption algorithms or no algorithm at all.

Nessus has detected that the remote SSH server is configured to use the Arcfour stream cipher or no cipher at all. RFC 4253 advises against using Arcfour due to an issue with weak keys.

Contact the vendor or consult product documentation to remove the weak ciphers

Any idea how to remove/disable the weak ciphers?

Re: How to disable SSH weak algorithm supported

OtakarKlier — Thu, 08 Mar 2018 22:46:39 GMT

Hello,

This might help.

https://www.paloaltonetworks.com/documentation/80/best-practices/best-practices-data-center/data-center-best-practice-security-policy/how-to-decrypt-data-center-traffic/create-the-data-center-best-practice-decryption-profile.html

Regards,

Re: How to disable SSH weak algorithm supported

jvarghese — Thu, 11 Oct 2018 18:13:46 GMT

Starting from PAN-OS 8.0 we have introduced the capability to select Ciphers for admin SSH connections. Run the following commands to disable weak Cipher Suits:

>configure
#delete deviceconfig system ssh

#set deviceconfig system ssh ciphers mgmt aes128-cbc
#set deviceconfig system ssh ciphers mgmt aes192-cbc
#set deviceconfig system ssh ciphers mgmt aes256-cbc
#set deviceconfig system ssh ciphers mgmt aes128-ctr
#set deviceconfig system ssh ciphers mgmt aes192-ctr
#set deviceconfig system ssh ciphers mgmt aes256-ctr
#set deviceconfig system ssh ciphers mgmt aes128-gcm
#set deviceconfig system ssh ciphers mgmt aes256-gcm

# set deviceconfig system ssh regenerate-hostkeys mgmt key-type RSA key-length 2048
# set deviceconfig system ssh session-rekey mgmt interval 3600

# commit

Exit from config mode by typing 'exit'

> set ssh service-restart mgmt

Re: How to disable SSH weak algorithm supported

louisbolanos — Fri, 12 Oct 2018 18:06:34 GMT

Having tried the manual cipher configuration on PAN VMs it then renders SSH useless from the client side. The error seen then is:

"no hostkey alg"

Re: How to disable SSH weak algorithm supported

sarumughan — Fri, 03 May 2019 17:25:49 GMT

Is there any other solution to fix in PANOS-7.1.14 with out upgarding to 8.x.x and running the mentioned command?

Re: How to disable SSH weak algorithm supported

cniwagaba — Fri, 19 Jul 2019 06:29:17 GMT

I found steps on the link below, I hope they will be helpful.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-cli-quick-start/get-started-with-the-cli/refresh-ssh-keys-mgt-port-connection#