IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  ISAM Virtual Appliance SSH restrictions on CipherSpecs

    Posted 12/18/19 06:29 AM
    Hello,


    Is it possible to limit the list of CipherSpecs for the management interface over the ssh?




    ------------------------------
    Igor Vinogradov
    ------------------------------


  • 2.  RE: ISAM Virtual Appliance SSH restrictions on CipherSpecs

    Posted 12/19/19 03:26 AM
    Hi Igor,
    For any version level at 8.0.1.3 or higher you can use an Advanced Tuning Parameter to address this. The advanced tuning parameter allows
    SSH ciphers to be specified as a list of entries, each separated by a comma ',' character. There is no validation done on the values - what you type is what will be used (so take care not to enter a wrong value otherwise SSH access may not work after deploying the changes).

    The parameter is:
    sshd.ciphers = aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc

    So to set this for strong ciphers, in the LMI navigate to:
    Manage System Settings -> System Settings -> Advanced Tuning Parameters,  then select New and set the fields as follows:

    Key: sshd.ciphers
    Value: aes128-ctr,aes192-ctr,aes256-ctr

    Save and deploy the changes, the LMI will be restarted automatically.

    Kind Regards,

    ------------------------------
    Phil Goodman
    IBM ISAM Support
    ------------------------------



  • 3.  RE: ISAM Virtual Appliance SSH restrictions on CipherSpecs

    Posted 12/19/19 05:33 AM
    Hi Phil, thanks for the answer

    Is there somewhere a detailed description of all the available options for:  sshd.* ?

    ------------------------------
    Igor Vinogradov
    ------------------------------

    Original Message


  • 4.  RE: ISAM Virtual Appliance SSH restrictions on CipherSpecs

    Posted 09/07/23 01:18 PM

    Hi, Phil, I don't know if you'd still receive my message after this long, however I'm currently hacing an issue with an ISVA 10, I did exactly what you said above to disabled  ssh-rsa256 since it is deprecated however and it is listed as a vulnerability, however when they run scan to see if it is disabled, ssh-rsa256 it still showing.

    is there any other way to disable the ciphers? 



    ------------------------------
    OSCAR SANCHEZ SERRANO
    ------------------------------

    Original Message


  • 5.  RE: ISAM Virtual Appliance SSH restrictions on CipherSpecs

    Posted 09/07/23 11:06 PM

    Oscar,

     

    What did you set sshd.ciphers to?  Phil's original post had two different values.  The sshd.ciphers parameter should be set to: "aes128-ctr,aes192-ctr,aes256-ctr".

     

    In my environment, when I set this value, I can see that the available SSHD ciphers is changed to the reduced list.  Please note however that this setting only changes the SSHD ciphers, and does not change the KEX algorithms, HostKey algorithms or MAC.

     

    I hope that this helps.

     

     

    Scott A. Exton
    Senior Software Engineer
    Chief Programmer - IBM Security Verify Access
    IBM Master Inventor

    cid4122760825*<a href=image002.png@01D85F83.85516C50">

     

     

     




    Original Message


Related Content