topic Is TLSv2 applicable for SSH in Network Security

Disable SSH CBC mode cipher encryption and disable MD5 and 96-bit MAC algorithms in SSH on Cisco ASA

balamuruganmanavalan — Tue, 12 Mar 2019 06:24:58 GMT

Hi all,

Want to disable CBC mode cipher encryption, and enable CTR or GCM cipher mode encryption and disable MD5 and 96-bit MAC algorithms

ASA version : 9.1.5(21)

Any idea.

Regards,

Bala

You can't, the options are

Karsten Iwen — Wed, 12 Aug 2015 12:34:35 GMT

You can't, the options are quite limited. But you can configure your SSH-clients not to negotiate weak ciphers.

Is any doc or cisco release

balamuruganmanavalan — Thu, 13 Aug 2015 06:03:51 GMT

Is any doc or cisco release notes stating that it is not possible?

Options are quite limited means?

If you want to use TLSv2

James Leinweber — Thu, 13 Aug 2015 19:12:52 GMT

If you want to use TLSv2 ciphersuites you are going to have to upgrade to 9.3 or higher; they aren't supported on earlier versions.

-- Jim Leinweber, WI State Lab of Hygiene

Is TLSv2 applicable for SSH

balamuruganmanavalan — Fri, 14 Aug 2015 03:32:11 GMT

Is TLSv2 applicable for SSH also? confirm.

No, TLS 1.2 in ASA versions 9

Karsten Iwen — Fri, 14 Aug 2015 07:01:06 GMT

No, TLS 1.2 in ASA versions 9.3 and higher can be used with the actual AnyConnect client. But it's unrelated to SSH.

To my knowledge it's not

Karsten Iwen — Fri, 14 Aug 2015 07:03:36 GMT

To my knowledge it's not documented that it's not possible ... Only the limited possibilities are documented, and that's mainly that you can restrict SSH to version 2 and configure the DH to group14.

Correct.Is there any cisco

balamuruganmanavalan — Fri, 14 Aug 2015 07:05:30 GMT

Correct.

Is there any cisco doc or release note showing that no workaround in Cisco ASA for SSH vulnerability.

If limited possibilities are documented, at least share that link.

All what you can do is

Karsten Iwen — Fri, 14 Aug 2015 07:08:19 GMT

All what you can do is documented in the config-guide.

you are referring which

balamuruganmanavalan — Fri, 14 Aug 2015 10:30:57 GMT

you are referring which config-guide. can you share the link?

http://www.cisco.com/c/en/us

Karsten Iwen — Fri, 14 Aug 2015 10:43:29 GMT

http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/admin_management.html

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s16.html

If we enable SSH

balamuruganmanavalan — Fri, 14 Aug 2015 12:28:18 GMT

If we enable SSH authentication, can we mitigate that vulnerability?

SSH always works with

Karsten Iwen — Fri, 14 Aug 2015 12:51:06 GMT

SSH always works with authentication. That's not related to the used ciphers.