At work we've been trying to move our external-facing services away from a policy of inclusivity (where we tried to accept as many people as possible) to a more security-focused setup.
The first step was pen-testing some of our core web applications, where the focus tends to be on weaknesses in the application code, but a lot has been said of the SSL/TLS suites and ciphers. Off the back of these test results, I have managed to at least get enough people interested in attaining the A-, A and A+ "grades" in the Qualys tests (management like quantifiable grades -- who knew?!).
However, another key component of some of our software is bulk-file upload/download via SFTP (i.e. over SSH). I always have tried to apply as good practice as I could determine on the SFTP servers, so we routinely use:
- key-only authentication
- blacklisting repeated authentication failures
- 2,048-bit keys
- disabling shell, exec and port-forwarding
But I must concede that I know very little about the crypto implementations, so the default settings have almost always been used. However, I presume that, if a pen-tester flags RC4, 3DES, MD5, et al. in a TLS-based setup, they would also flag these algorithms in an SFTP server (were it included within their scope).
I'm primarily working on a Windows stack, and we've been using VanDyke VShell as our SFTP server of choice for a number of years. By default, it enables all Cipher and MAC options (except for 'None') and all Key Exchange options except for 'Kerberos' and 'Kerberos (Group Exchange)'.
This leaves the following algorithms, as named by the VShell application:
- Key Exchange: diffie-hellman-group14, diffie-hellman, diffie-hellman-group
- Cipher: AES-256-CTR, AES-192-CTR, AES-128-CTR, AES-256, AES-192, AES-128, Twofish, Blowfish, 3DES, RC4
- MAC: SHA1, SHA1-96, MD5, MD5-96, UMAC-64 (and, in more recent versions) SHA2-512, SHA2-256
As for the questions:
- Where are the best references for me to determine which of these are now considered too weak to use?
- How can I best-determine whether disabling any of these will adversely affect my end-users?
- Are there any Qualys-like tests that I can use to regularly evaluate these servers, preferably with compelling evidence with which to beat management into submission?
UMAC-64
particularly useful? Besides, I thought SHA1 was still safe-enough for message authentication -- is that no longer the case?