topic Re: Cisco ISE SSH ciphers in Network Access Control

Cisco ISE SSH ciphers

umahar — Fri, 24 May 2019 20:26:04 GMT

Hi,

An infosec team is in the process of certifying ISE and is seeking clarification on the various parameters used in SSH.

Should use only below approved key exchanges.

KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256

Use Only below approved MACs

MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com

Use only below Host Keys

HostKey ecdsa-sha2-nistp521-cert-v01@openssh.com

HostKey ecdsa-sha2-nistp384-cert-v01@openssh.com

HostKey ecdsa-sha2-nistp256-cert-v01@openssh.com

HostKey ecdsa-sha2-nistp521

HostKey ecdsa-sha2-nistp384

HostKey ecdsa-sha2-nistp256

HostKey ssh-ed25519-cert-v01@openssh.com

Is there any documentation which talks about it ?

Appreciate if anyone can point me in that direction.

If not then should we just look at the Red Hat documentation to verify these parameters as it is the underlying OS.

However in the past we have had to seek TAC's help to enable strong ciphers via root patch.

Re: Cisco ISE SSH ciphers

Jason Kunst — Sat, 25 May 2019 11:49:20 GMT

We have this but I think we need to dig deeper

https://community.cisco.com/t5/security-documents/ise-security-best-practices-hardening/ta-p/3640651

Re: Cisco ISE SSH ciphers

hslai — Sat, 25 May 2019 19:29:46 GMT

Recent ISE Releases have some options for SSH. See the configuration mode command service

ise-1/admin(config)# service sshd ?
  enable                  Enable sshd service
  encryption-algorithm    Configure SSH encryption algorithms. supported algorithms are a
  encryption-mode         Configure SSH encryption mode on system. Supported modes are cb
  key-exchange-algorithm  Specify allowable key exchange algorithms for sshd service
  loglevel                Log level of messages from sshd to secure system log

If you need additional options, please remember to ask TAC to file new bugs if no existing ones fit the bills.

Re: Cisco ISE SSH ciphers

umahar — Tue, 28 May 2019 14:53:15 GMT

Hi Hsing,

Which ISE version are you using ?

I am using 2.4 and not seeing the same output ?

Re: Cisco ISE SSH ciphers

Jason Kunst — Wed, 29 May 2019 19:21:45 GMT

I am running patch 8 on 2.4 and see the same as hsing