Disabling 3des-cbc for SSH

[ER2022]

Hi,

I would like to remove 3des-cbc for SSH as this was identified as deprecated ssh cryptographic settings.

does this mean if you disable 3des-cbc all the aes-cbc mode will be disable right?

And what is the impact on the switch operation?

3des-cbc Three-key 3DES in CBC mode
aes128-cbc AES with 128-bit key in CBC mode
aes128-ctr AES with 128-bit key in CTR mode
aes192-cbc AES with 192-bit key in CBC mode
aes192-ctr AES with 192-bit key in CTR mode
aes256-cbc AES with 256-bit key in CBC mode
aes256-ctr AES with 256-bit key in CTR mode

Thank you in advance,

Elmani

[balaji.bandi]

You can make custom as mentioned below : (to mitigate the issue)  - make sure you running  SSHv2

https://community.cisco.com/t5/security-documents/guide-to-better-ssh-security/ta-p/3133344

Note : this suggestion based on the information, if this is not meet the requirement, provide what is the device and IOS coder running, along with show ip ssh output.

[ER2022]

Thanks BB,

The target switch(WS-C3850-48P) is running on 03.03.01SE

and ip ssh output:

SSH Enabled - version 2.0
Authentication methods:publickey,keyboard-interactive,password
Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
MAC Algorithms:hmac-sha1,hmac-sha1-96
Authentication timeout: 60 secs; Authentication retries: 2
Minimum expected Diffie Hellman key size : 1024 bits

The cipher for SSH is already existing as above, now if I remove 3des-cbc, this mean all aes-cbc will be remove as well?

and what is the impact on the switch operation?

[marce1000]

           >...The cipher for SSH is already existing as above, now if I remove 3des-cbc, this mean all aes-cbc will be remove as well?

 - You can verify this , for instance , with : 

nmap --script ssh2-enum-algos ciscodevicename

 M.