SSH Vulnerability

[Vinod Ola]

Hi There- We have received ssh vulnerability scanned by Rapid7 and I can't see that encryption in switch configuration as we already using SSH version2

SSH Birthday attacks on 64-bit block ciphers (SWEET32) (Recommendation is to disable 3DES)

[balaji.bandi]

go to switch and issue -  show ip ssh - will give you all the cipher suite for you.

[Vinod Ola]

It's not showing when I  run show ip ssh

please see below 

sho ip ssh
SSH Enabled - version 2.0
Authentication timeout: 60 secs; Authentication retries: 2

[balaji.bandi]

What is the device Model, what ios Code running :

What you see the Logs

when you issue show ip ssh (you see what ciphers accepted)

example :

#show ip ssh
SSH Enabled - version 2.0
Authentication methods:publickey,keyboard-interactive,password
Authentication Publickey Algorithms:x509v3-ssh-rsa,ssh-rsa,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,x509v3-ecdsa-sha2-nistp256,x509v3-ecdsa-sha2-nistp384,x509v3-ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512
Hostkey Algorithms:x509v3-ssh-rsa,rsa-sha2-512,rsa-sha2-256,ssh-rsa
Encryption Algorithms:aes128-gcm,aes256-gcm,aes128-ctr,aes192-ctr,aes256-ctr
MAC Algorithms:hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512
KEX Algorithms:ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 2048 bits

[Vinod Ola]

Switch Ports Model SW Version SW Image
------ ----- ----- ---------- ----------
* 1 28 WS-C2960S-24TS-L 12.2(55)SE8 C2960S-UNIVERSALK9-M

-----------------------------------------------------------

sho ip ssh
SSH Enabled - version 2.0
Authentication timeout: 60 secs; Authentication retries: 2

---------------------------------------------------------

There is nothing in logs related to ssh

[Vinod Ola]

Hi Everyone, Can anyone suggest the fix for above issue?

[balaji.bandi]

try change as below (do it in maintenance window)

#config t
(config)#ip domain-name yourdomain.com
(config)#crypto key generate rsa

1024 or 2038

[Vinod Ola]

it's already configured as you mentioned. 

[balaji.bandi]

reconfigure again