Switches, Hubs, and Modems
cancel
Showing results for 
Search instead for 
Did you mean: 

Hint: disable SSH v2 on 5300XLs!

Markku Leinio
Valued Contributor

Hint: disable SSH v2 on 5300XLs!

Based on my experiences, I strongly advice all Procurve 5300XL users to disable SSH version 2 support.

In a certain way it is possible to cause the 5300XL to reload (system crash) by a remote SSH v2 connection attempt, with any password (even incorrect password). All the cracker needs is a 5300XL waiting for SSH v2 connection and access to that listening port.

HP is still investigating this issue. I have seen this in both our 5300XLs (configured for totally different environments and by different people) running various software versions E.07.xx, including the latest E.07.30, with SSH version 2 server enabled. With SSH version 1 server I haven't been able to crash the switch.

My suggestion is to use only SSH version 1 or to prevent port 22 access from untrusted addresses by access control lists.

Hopefully HP will get a fix for this soon. I will report here any progress on this case.
4 REPLIES
Markku Leinio
Valued Contributor

Re: Hint: disable SSH v2 on 5300XLs!

Just to keep you awake: no further comments from HP dispite the fact that they were first contacted with this issue in May.
Mark Landin
Valued Contributor

Re: Hint: disable SSH v2 on 5300XLs!

Not even a security bulletin?

You might try spreading this info around some of the more well-known security and bugtracking sites. Sometimes a little publicity can motivate a reticent vendor...
Markku Leinio
Valued Contributor

Re: Hint: disable SSH v2 on 5300XLs!

I am not aware of any kind of notices by HP in this issue.

After reporting my experiences the engineers said that they tested it, but didn't find the same situation. They suspected that the 10/100 modules were defective (according to the date codes in the boards) and I was sent new modules, which I installed. Nothing changed, however, the fault remains.

I tried with 07.2x and 07.30 firmware, they are equal with this issue.

Two weeks ago we got our second 5304XL (with 100/1000T and mini-GBIC modules only). I immediately tested it, and the same fault occurred. I don't believe this is a hardware issue.

I will still try the HP e-mail support, and then I'll consider some other actions.
Markku Leinio
Valued Contributor

Re: Hint: disable SSH v2 on 5300XLs!

Looks like E.08.01 doesn't have that problem anymore. I would still keep from using SSH v2 in 5300XL yet.