How to disable RSA/SHA1 on Palo alto device for SSH access

cancel
Showing results for 
Search instead for 
Did you mean: 

How to disable RSA/SHA1 on Palo alto device for SSH access

L3 Networker

 

We are using OpenSSH v8.2 cannot connect to SSH hosts with SSH Proxy enabled (SSH Decryption).

 

Testing showing that this is due to the Palo Alto attempting to use RSA with SHA1 which has been removed by OpenSSH in v8.2.

 

 

Is there a way we can configure the Palo Alto to disable RSA/SHA1 for SSH?

 

2 REPLIES 2

Cyber Elite
Cyber Elite

Hello,

If these hosts are internal, why not bypass decryption for them from trusted hosts/users? 

 

Regards,

L0 Member

to set the cipher suites only on the management interface, you can use a profile for SSH the set of commands is 

> configure
# delete deviceconfig system ssh
# set deviceconfig system ssh ciphers mgmt aes256-ctr
# set deviceconfig system ssh ciphers mgmt aes256-gcm
# set deviceconfig system ssh default-hostkey mgmt key-type ECDSA 256
# set deviceconfig system ssh regenerate-hostkeys mgmt key-type ECDSA key-length 256
# set deviceconfig system ssh session-rekey mgmt interval 3600
# set deviceconfig system ssh mac mgmt hmac-sha2-256
# set deviceconfig system ssh mac mgmt hmac-sha2-512

# commit

# exit
> set ssh service-restart mgmt
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!