Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some network issues in my network due to misconfiguration of Cisco router and switches. Please give me some advice or solutions to fix these vulnerabilities and configuration issues.

  1. Vulnerability Name: SSH CBC Mode Ciphers Enabled
    Description: CBC Mode Ciphers are enabled on the SSH Server
    Solution: Disable CBC Mode Ciphers and use CTR Mode Ciphers

  2. Vulnerability Name: SSH Insecure HMAC Algorithms Enabled
    Description: Insecure HMAC Algorithms are enabled
    Solution: Disable any 96-bit HMAC Algorithms, Disable any MD5-based HMAC Algorithms.

share|improve this question
    
What version of IOS are you running? – NULLZ Aug 27 '13 at 8:36
up vote 3 down vote accepted

There is no way to enforce this on a Cisco router. The only thing you can do to harden your setup is to at least disable SSHv1 by running:

#ip ssh version 2

However this will still not disable CBC and 96-bit HMAC/MD5 algorithms. Cisco does not offer capabilities to fine tune your SSH server so deeply. The only thing you can do is force the a connection towards the server which does not use any of the above mentioned algorithms. Note that the client needs to do this and that it can't be forced to the client by the server.

Here you can see what options the SSH client on a Cisco router has available to initiate an SSH connection:

ssh [-v {1 | 2} |-c {aes128-ctr |aes192-ctr|aes256-ctr |aes128-cbc | 3des-cbc | aes192-cbc | aes256-cbc} |-l user-id | -l user-id:vrf-name number ip-address ip-address | -l user-id:rotary number ip-address | -m {hmac-md5 | hmac-md5-96 | hmac-sha1 | hmac-sha1-96} | -o numberofpasswordprompts n | -p port-num] {ip-addr | hostname} [command | -vrf] 
share|improve this answer
    
No longer accurate. – Gert van den Berg Jan 14 at 6:57

A feature request to add the functionality seems to have been resolved in recent IOS releases, adding the functionality.

On (very) recent IOS versions (possibly restricted to certain trains, the documentation is extremely sparse), you should be able to:

> enable
# configure terminal
(config)# ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
(config)# ip ssh server algorithm mac hmac-sha1

You might want to check with "?" if better options have since become available, especially from the MACs before using my list as-is...

Not directly related, but you likely also want this in the config:

(config)# ip ssh version 2

SSH Configuration guide (The commands aren't in the master command list yet, interestingly enough...)

share|improve this answer
1  
It took them 2 years? wow :/ – Lucas Kauffman Jan 14 at 7:15
    
@LucasKauffman: And it seems like it was resolved in the last week.. – Gert van den Berg Jan 14 at 7:32

You might need to upgrade your IOS tot he latest version and check the IOS support for strong cipher suites.

share|improve this answer

protected by Community Apr 16 '14 at 2:42

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.