Possible to disable SSH CBC cipher and weak MAC hashing?

[boss82]

Hi,

May I check if it is possible to disable SSH CBC cipher and weak MAC hashing on Palo Alto Firewall?

If so, may I know how to do it.

Had no luck searching for a solution online.

Seems like there is no menu/config file (e.g. /etc/ssh/ssh_config) to edit such settings.

This is with relation to Nessus vulnerability findings.

Try to see how it can be addressed.

https://www.tenable.com/plugins/index.php?view=single&id=70658

https://www.tenable.com/plugins/index.php?view=single&id=71049

Thank you in advance

[mmmccorkle]

Hey,

Even the latest Pan-OS version running in FIPS mode still has cbc enabled. There is not a way to modify this. 

Non-FIPS/CC mode 

Decryption (SSHv2 only) 

Ciphers: aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc 

MAC Algorithms: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 

aes192-ctr

aes256-ctr

aes128-gcm

aes256-gcm

FIPS/CC mode 

HMAC – HMAC-SHA-1 

Authentication – RSA (2048 bit key only) 

Key agreement – DH Group 14 (2048 bit) 

Symmetric Algorithm – AES128, AES192, or AES256 (CBC or CTR for all three) 

[Dave_Fitzjarrell]

Good link for setting ciphers.  Remember do not include CBC in your config.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-cli-quick-start/get-started-with-the-cli/refresh...

For MAC's I used these:

configure
set deviceconfig system ssh mac mgmt hmac-sha1
set deviceconfig system ssh mac mgmt hmac-sha2-256
set deviceconfig system ssh mac mgmt hmac-sha2-512
commit