ASA CiscoSSH Stack vs ASA Proprietary SSH stack

Arne Bier — Thu, 29 May 2025 10:29:14 GMT

Hello

ASA 9.20 release (on FPR2100 device). I had a TAC case about TACACS+ Remote Address = 0.0.0.0 in certain Authentication Requests (when using public key auth, and also in Authorization requests) - the TAC told me to "no ssh stack ciscossh" - that fixed the TACACS+ Remote Address issue (it's populated correctly in this mode). I wasn't aware of the "proprietary SSH stack" until now.

Anyone know what the downsides are of running this SSH stack vs the CiscoSSH? I don't need FIPS compliance. I am more concerned about the TACACS+ Remote Address working.

I can't be sure, but it sounds like CiscoSSH is updated more regularly (due to the openssh link) - but does that mean the other stack is not maintained? Cisco docs don't explain that well. And then then obvious question: has any pen testing been done to compare the two stacks and how they compare?

Re: ASA CiscoSSH Stack vs ASA Proprietary SSH stack

ahollifield — Thu, 29 May 2025 15:41:23 GMT

@Ashley Pilbeam I know you have explained this in the past in the FirePower Foundry Webex Space.

topic ASA CiscoSSH Stack vs ASA Proprietary SSH stack in Network Security

ASA CiscoSSH Stack vs ASA Proprietary SSH stack

Re: ASA CiscoSSH Stack vs ASA Proprietary SSH stack