Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I have some network issues in my network due to misconfiguration of Cisco router and switches. Please give me some advice or solutions to fix these vulnerabilities and configuration issues.

  1. Vulnerability Name: SSH CBC Mode Ciphers Enabled
    Description: CBC Mode Ciphers are enabled on the SSH Server
    Solution: Disable CBC Mode Ciphers and use CTR Mode Ciphers

  2. Vulnerability Name: SSH Insecure HMAC Algorithms Enabled
    Description: Insecure HMAC Algorithms are enabled
    Solution: Disable any 96-bit HMAC Algorithms, Disable any MD5-based HMAC Algorithms.

share|improve this question
What version of IOS are you running? – NULLZ Aug 27 '13 at 8:36

2 Answers 2

up vote 3 down vote accepted

There is no way to enforce this on a Cisco router. The only thing you can do to harden your setup is to at least disable SSHv1 by running:

#ip ssh version 2

However this will still not disable CBC and 96-bit HMAC/MD5 algorithms. Cisco does not offer capabilities to fine tune your SSH server so deeply. The only thing you can do is force the a connection towards the server which does not use any of the above mentioned algorithms. Note that the client needs to do this and that it can't be forced to the client by the server.

Here you can see what options the SSH client on a Cisco router has available to initiate an SSH connection:

ssh [-v {1 | 2} |-c {aes128-ctr |aes192-ctr|aes256-ctr |aes128-cbc | 3des-cbc | aes192-cbc | aes256-cbc} |-l user-id | -l user-id:vrf-name number ip-address ip-address | -l user-id:rotary number ip-address | -m {hmac-md5 | hmac-md5-96 | hmac-sha1 | hmac-sha1-96} | -o numberofpasswordprompts n | -p port-num] {ip-addr | hostname} [command | -vrf] 
share|improve this answer

You might need to upgrade your IOS tot he latest version and check the IOS support for strong cipher suites.

share|improve this answer

protected by Community Apr 16 '14 at 2:42

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.