- Community Home
- >
- Networking
- >
- Switching and Routing
- >
- Comware Based
- >
- Re: HPE Switch- SSH Vulnerabilities
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-30-2021 11:20 PM
03-30-2021 11:20 PM
HPE Switch- SSH Vulnerabilities
Customer may see following Plugin name or Vulnerabilities on their security assessment report. Below table is example one, but the plugin name will be same for all customer
Plugin Name
SSH Server CBC Mode Ciphers Enabled
Plugin Output: The following client-to-server Cipher Block Chaining (CBC) algorithms are supported : 3des-cbc aes128-cbc aes256-cbc des-cbc The following server-to-client Cipher Block Chaining (CBC) algorithms are supported : 3des-cbc aes128-cbc aes256-cbc des-cbc
SSH Weak MAC Algorithms Enabled
The following client-to-server Message Authentication Code (MAC) algorithms are supported : hmac-md5 hmac-md5-96 hmac-sha1-96 The following server-to-client Message Authentication Code (MAC) algorithms are supported : hmac-md5 hmac-md5-96 hmac-sha1-96
For ssh, there is no way to disable the CBC cipher. However the client can use SSH2 to communicate with the switch and choose the cipher as below for better security.
The below example will be applicable only for Com7 models . On COM5 router , where we don’t have SSH2 support . Due to this we cannot select the cipher suite to disable the weak MAC algorithm and CBC Ciphers. This is the limitations on this device and we don’t have option to fix this vulnerabilities.
[5940-133-32]ssh2 algorithm cipher ?
3des-cbc 3DES-CBC
aes128-cbc AES128-CBC
aes128-ctr AES128-CTR
aes128-gcm AES128_GCM
aes192-ctr AES192-CTR
aes256-cbc AES256-CBC
aes256-ctr AES256-CTR
aes256-gcm AES256_GCM
des-cbc DES-CBC
Config Example for SSH:
==
ssh server enable
undo ssh server compatible-ssh1x enable
ssh2 algorithm cipher aes128-ctr aes192-ctr aes256-ctr aes128-gcm aes256-gcm
ssh2 algorithm mac sha1 sha2-256 sha2-512
==
I work for HPE
![Accept or Kudo](/html/assets/hpe_banner_SME_signature.png)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
04-05-2021 03:01 AM
04-05-2021 03:01 AM
Re: HPE Switch- SSH Vulnerabilities
Hello @jmpk ,
Thank you for sharing this informative post on the SSH Vulnerabilities HPE Switch.
I m sure our customers would use this information for their understanding.
Reagrds,
Ramya H
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
04-06-2021 08:43 AM
04-06-2021 08:43 AM
Re: HPE Switch- SSH Vulnerabilities
Hi, I don't understand...is it a recognized security vulnerability (recognized = there is a specific HPE/Aruba Security Bullettin about it or is cited on an already published HPE/Aruba Security Bullettin) or what? If so - if it is a recognized security vulenerability - what HPE/Aruba Security Bullettin should we read to understand workarounds and affected switch series/versions, if any?
I'm not an HPE Employee
![Kudos and Accepted Solution banner](https://community.hpe.com/html/assets/hpe_banner_SME_signature.png)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
04-15-2021 11:17 PM
04-15-2021 11:17 PM
Re: HPE Switch- SSH Vulnerabilities
Do we need to re-create the account when we enable SSH2?