SSH Weak MAC Algorithms Enabled on Huawei Switches & Routers

Nessus / Qualys scan

Description

The remote SSH server is configured to allow either MD5 or 96-bit MAC algorithms, both of which are considered weak.

Note that this plugin only checks for the options of the SSH server, and it does not check for vulnerable software versions. 

Output

• The following client-to-server Message Authentication Code (MAC) algorithms
  are supported : 
  
    hmac-md5
    hmac-md5-96
    hmac-sha1-96
    hmac-sha2-256-96
  
  The following server-to-client Message Authentication Code (MAC) algorithms
  are supported : 
  
    hmac-md5
    hmac-md5-96
    hmac-sha1-96
    hmac-sha2-256-96
  

Solution:

The server and client negotiate the algorithm for checking packets transmitted between them. 

You can run the ssh server hmac command to configure the check algorithm list of the SSH server. 

    The server compares the check algorithm list sent from the client with its own check algorithm list, and selects the first matched check algorithm for checking transmitted packets. If the check algorithm lists of the server and client have no common check algorithm, the check algorithm negotiation fails. Add the below command to negate the issue.

<HUAWEI> system-view
[~HUAWEI] ssh server hmac sha2_256

SSH Server CBC Mode Ciphers Enabled on Huawei Switches & Routers

Nessus / Qualys scan

Description

The SSH server is configured to support Cipher Block Chaining (CBC) encryption. This may allow an attacker to recover the plaintext message from the ciphertext.

Note that this plugin only checks for the options of the SSH server and does not check for vulnerable software versions.

Output

• The following client-to-server Cipher Block Chaining (CBC) algorithms
  are supported : 
  
    3des-cbc
    aes128-cbc
    aes256-cbc
  
  The following server-to-client Cipher Block Chaining (CBC) algorithms
  are supported : 
  
    3des-cbc
    aes128-cbc
    aes256-cbc
  

Solution

This solution is for Huwaei Network equipment 

You need to stop the switches and other eqipments from using the CBC algorithm. So Configure CTR algorithm which is more secure to be used with SSH.

Configure CTR encryption algorithms for an SSH server.

<HUAWEI> system-view
[~HUAWEI] ssh server cipher aes256_ctr aes128_ctr