Terrapin vulnerability on c7000 virtual connects managed by HPE OneView

[jdkarpin]

Hi, 
We've managed to disable CBC-EtM support on Virtual Connects that are not managed by HPE OneView using:

set ssh -quiet CBC-cipher=Disabled

Virtual Connects managed by HPE OneView are not accessible though ssh and therefore we cannot disable this cipher. 

How to either access VC over SSH or disable it from HPE OneView?

[ChrisLynch]

Virtual Connect Manager is not a running service when the enclosure is managed by OneView.  There is no ability to disable specific ciphers on the Ethernet modules private API interfaces.

[jdkarpin]

@ChrisLynch 

Hi Chris,
Issue is that SSH is enabled on VC even when VCM is disabled.
SSH gets flagged as vulnerable to Terrapin in our environment.
Any idea what can be done about it?

[ChrisLynch]

SSH is only present to transfer firmware images during the module firmware update process.  Otherwise, it is not customer accessible.  Nothing further can be done here.

[jdkarpin]

Hi @ChrisLynch ,

SSH is only present to transfer firmware images during the module firmware update process.

Looks like it's not true. SSH is enabled 100% of the time. 

Vulnerable VC

[Moderator edit: Erased the confidential info.]

[ChrisLynch]

I didn't say that SSH would be started "on-demand" or the daemon would only start for firmware updates.  SSH is only used for SCP to transfer firmware updates to the VC modules.  However, no customer can access that interface.

[jdkarpin]

Hi Chris,

On our environment SSH is contantly running on virtual connects. 

How do we get access to virtual connect when it's managed by HPE OneView?

How to get password for vcmadm_?

[ChrisLynch]

As I stated previously, there is no way to disable SSH on Virtual Connect modules even managed by OneView.  SSH here is strictly used to transfer firmware updates for the VC modules only.  We do not expose a general purpose SSH interface anyhow.

[jdkarpin]

Our security team seams to not understand this argument. 

I do not want to disable SSH on Virtual Connect - I want to get in and disable cipher that is vulnerable. 

[DanCernese]

Does the security team understand his previous response:

"Virtual Connect Manager is not a running service when the enclosure is managed by OneView.  There is no ability to disable specific ciphers on the Ethernet modules private API interfaces."

[jdkarpin]

On our virtual connects ssh is enabled at all times, and we've noticed that hpe one view 6.60 establishes a constant connection (according to packet capture), even when we're not working with interconnects.

Given this situation, I kindly request that you reach out to our software engineers. Could you ask them to explore potential workarounds? It seems that HPE OneView is somehow authenticating with Virtual Connect, and if we could obtain the password, it might help resolve our problem.

[DanCernese]

You're not getting the message.  There is no password.  There is no command line.  There is no feature in the private API that OneView is using to disable specific cyphers.