ProLiant DL380 Gen10 - SSH SHA-1 HMAC Algorithms Enabled (Port 22)

[sakura87c]

How can I disable SHA-1 and HMAC algorithms on the SSH service of iLO 5?

There is no option i iLO5 portal and, if High Security is applied in Encrytion settings, weak ciphers like sha1 and ssh-rsa are still used, see SSH trace:

[LOCAL] : SEND : KEXINIT

[LOCAL] : RECV : Read kexinit

[LOCAL] : Available Remote Kex Methods = diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,ecdh-sha2-nistp384

[LOCAL] : Selected Kex Method = diffie-hellman-group14-sha1

[LOCAL] : Available Remote Host Key Algos = ssh-rsa

[Greeshma21]

Hi @sakura87c 

You can refer to this document. It might help you.

Regards,
Greeshma

[sakura87c]

That document explains hot to configure sshd_config, and that's not possinble in iLO5 environment.

[Bunsol]

Please check if this is the setting you are looking for:-
https://support.hpe.com/hpesc/public/docDisplay?docId=a00105236en_us&docLocale=en_US&page=GUID-53B58A1B-438D-46EA-B867-54B3D0F56F9E.html

[sakura87c]

Hi,

Thanx a lot for link!!

For me it is clear now that Security State must be set to High Security in order to disable weak ciphers.

However, High Security is still not disabling weak SSH HostKey ssh-rsa. How can I change SSH HostKey, for instance, to ssh-dsa?

[Bunsol]

Weak SSH host key needs to be disabled from the Operating system. Please check with the OS vendor for the same.

[sakura87c]

Hello @Bunsol ,

As I posted previously, following line is traced form my SSH client:

[LOCAL] : Available Remote Kex Methods = diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,ecdh-sha2-nistp384

This means that server my ssh client is connecting to is suggesting KexMethods available from server side.

Actually, as per documentation you provided: https://support.hpe.com/hpesc/public/docDisplay?docId=a00105236en_us&docLocale=en_US&page=GUID-53B58A1B-438D-46EA-B867-54B3D0F56F9E.html

It says clearly that  diffie-hellman-group14-sha1 is only supported in Production state, not in High Security, see documentation:

Production

• AES256-CBC, AES128-CBC, 3DES-CBC, AES256-CTR, AEAD_AES_256_GCM, and AES256-GCM ciphers

  • diffie-hellman-group-exchange-sha256, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1, and ecdh-sha2-nistp384 key exchange

  • hmac-sha1, hmac-sha2-256, and AEAD_AES_256_GCM MACs

FIPS or High Security

• AES256-CTR, AEAD_AES_256_GCM, and AES256-GCM ciphers

  • diffie-hellman-group-exchange-sha256 and ecdh-sha2-nistp384 key exchange

  • hmac-sha2-256 or AEAD_AES_256_GCM MACs

So why is server suggesting this cipher?

[Bunsol]

These are the modes available. If you want to understand why these ciphers are used please log a support case so that this can be investigated further.

[sakura87c · Accepted solution]

Hello,

I have updated iLO firmware to 3.08 and weak ciphers have disappeared. See SSH client trace:

[LOCAL] : Available Remote Kex Methods = diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp384

[LOCAL] : Selected Kex Method = ecdh-sha2-nistp384

[LOCAL] : Available Remote Host Key Algos = rsa-sha2-512,rsa-sha2-256

[LOCAL] : Selected Host Key Algo = 

[LOCAL] : Available Remote Send Ciphers = aes256-ctr,AEAD_AES_256_GCM,aes256-gcm@openssh.com

[LOCAL] : Selected Send Cipher = aes256-ctr

[LOCAL] : Available Remote Recv Ciphers = aes256-ctr,AEAD_AES_256_GCM,aes256-gcm@openssh.com

[LOCAL] : Selected Recv Cipher = aes256-ctr

[LOCAL] : Available Remote Send Macs = hmac-sha2-256,AEAD_AES_256_GCM

[LOCAL] : Selected Send Mac = hmac-sha2-256

[LOCAL] : Available Remote Recv Macs = hmac-sha2-256,AEAD_AES_256_GCM

[LOCAL] : Selected Recv Mac = hmac-sha2-256

For me this issue is solved already.

Cheers!!

[Sunitha_Mod]

Hello @sakura87c,

That's Awesome! 

We are extremely glad to know the issue has been resolved and we appreciate you for keeping us updated.