Disabled SSH Weak MAC Algo and CBC mode Ciphers

[freddyliaw91]

I need a guidance on disabling ssh weak MAC Algorithms and SSH CBC mode ciphers.

I got a CISCO ASA 5510 device. Appreciate if someone could help me. Need advise urgently.

[Rishabh Seth]

Hi,

You can use following command to see what are the configured algorithm:

# show run all ssl

Then based on our requirement you can use following command to remove/add ssl algorithms:

#  ssl encryption <algo-name>

#  no ssl encryption <algo-name>

Hope it helps!!!

Thanks,

R.Seth

Mark the answer as correct if it helps in resolving your query!!!

[freddyliaw91]

Thanks for prompt response. However, in my case is SSH not SSL.

[Rishabh Seth]

Hi,

I understand that you are using ssh, but all the encryptions algorithms are configured under SSL hierarchy on ASA.

Refer:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s16.html#pgfId-1562163

Let us know if this helps in resolving your issue.

Thanks,

R.Seth

[Rishabh Seth]

You can also refer:

https://supportforums.cisco.com/discussion/12209596/how-disable-aes-cbc-encryption-asa-5545

[freddyliaw91]

The command has been applied.

However, we still can see the encryption key.

Please, see the attachment for the result.

[Rishabh Seth]

Hi,

Use "show run ssl" to see the ssl encryption algorithm in your running configuration.

I think you will not see the encryption algo in running configuration as you have deleted it.

Hope it helps!!!

Thanks,

R.Seth

Mark the answer as correct if it helps in resolving your query!!!

[Rishabh Seth]

You can change ssl settings via ASDM as well.

Navigate through  Configuration > Device Management > SSL Settings.

Under this hierarchy you can easily check what is active and based on your requirement you can edit the settings.

Hope it helps!!!

Thanks,

R.Seth

[freddyliaw91]

Hi,

The issue still remain the same. I still able to connect with weak ciphers