topic Re: How to disable RSA/SHA1 on Palo alto device for SSH access in General Topics

How to disable RSA/SHA1 on Palo alto device for SSH access

Jatin.Singh — Tue, 20 Jul 2021 22:55:43 GMT

We are using OpenSSH v8.2 cannot connect to SSH hosts with SSH Proxy enabled (SSH Decryption).

Testing showing that this is due to the Palo Alto attempting to use RSA with SHA1 which has been removed by OpenSSH in v8.2.

Is there a way we can configure the Palo Alto to disable RSA/SHA1 for SSH?

Re: How to disable RSA/SHA1 on Palo alto device for SSH access

OtakarKlier — Wed, 21 Jul 2021 14:57:32 GMT

Hello,

If these hosts are internal, why not bypass decryption for them from trusted hosts/users?

Regards,

Re: How to disable RSA/SHA1 on Palo alto device for SSH access

blocker95848 — Thu, 22 Jul 2021 09:58:41 GMT

to set the cipher suites only on the management interface, you can use a profile for SSH the set of commands is

> configure
# delete deviceconfig system ssh
# set deviceconfig system ssh ciphers mgmt aes256-ctr
# set deviceconfig system ssh ciphers mgmt aes256-gcm
# set deviceconfig system ssh default-hostkey mgmt key-type ECDSA 256
# set deviceconfig system ssh regenerate-hostkeys mgmt key-type ECDSA key-length 256
# set deviceconfig system ssh session-rekey mgmt interval 3600
# set deviceconfig system ssh mac mgmt hmac-sha2-256
# set deviceconfig system ssh mac mgmt hmac-sha2-512

# commit

# exit
> set ssh service-restart mgmt

Re: How to disable RSA/SHA1 on Palo alto device for SSH access

zmacharia_PA — Sun, 16 Jul 2023 17:54:30 GMT

You can also configure the SSH profile directly from the firewall; caveat - you will still need to run the restart command listed above by @Blocker95848

Re: How to disable RSA/SHA1 on Palo alto device for SSH access

TomYoung — Mon, 17 Jul 2023 01:23:10 GMT

Hi @Jatin.Singh ,

That is a great question. It would be nice to disabled protocols on the SSH Proxy tab of the decryption profile, but you can't. The only purpose for SSH Proxy is to be able to detect the ssh-tunnel App-ID. The NGFW does not actually perform content inspection on the decrypted traffic. I would disable it as @OtakarKlier mentioned.

Thanks,

Tom