Is there a way to restrict IOS ssh server to only accept certain ciphers?

Is there a way to restrict IOS ssh server to only accept certain ciphers?
NewsGroups | Search | Tools
User Password
Register Now! Lost Password?
 comp.dcom.sys.cisco  Post an article  get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content  add this group's latest topics to your Google content  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
Is there a way to restrict IOS ssh server to only accept certain ciphers? Heath Roberts 04-17-2008
Posted by Heath Roberts on April 17, 2008, 3:17 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
For example, let's say I want to allow 3DES but not DES. Can I do
that? I don't see any options in the IOS Security Configuration Guide
or Reference, or in the O'Reilly IOS Cookbook...

Thanks in advance,
Heath

NMFall 20%
Posted by News Reader on April 17, 2008, 3:32 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Heath Roberts wrote:
> For example, let's say I want to allow 3DES but not DES. Can I do
> that? I don't see any options in the IOS Security Configuration Guide
> or Reference, or in the O'Reilly IOS Cookbook...
>
> Thanks in advance,
> Heath

You have control over the version of SSH used on the Cisco device. e.g.:
ip ssh version 2

I just did a capture and found the following on the Server Key Exchange
which suggests that the SSHv2 on my device, doesn't support single DES:

Take a look and see if you agree:

SSH Protocol
SSH Version 2
Packet Length: 276
Padding Length: 4
Key Exchange
Msg code: Key Exchange Init (20)
Algorithms
Cookie: A19351FD6DAA335B5A7EED46E647C9FB
kex_algorithms length: 26
kex_algorithms string: diffie-hellman-group1-sha1
server_host_key_algorithms length: 7
server_host_key_algorithms string: ssh-rsa
encryption_algorithms_client_to_server length: 41
encryption_algorithms_client_to_server string:
aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
encryption_algorithms_server_to_client length: 41
encryption_algorithms_server_to_client string:
aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
mac_algorithms_client_to_server length: 43
mac_algorithms_client_to_server string:
hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96
mac_algorithms_server_to_client length: 43
mac_algorithms_server_to_client string:
hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96
compression_algorithms_client_to_server length: 4
compression_algorithms_client_to_server string: none
compression_algorithms_server_to_client length: 4
compression_algorithms_server_to_client string: none
languages_client_to_server length: 0
languages_server_to_client length: 0
Payload: 0000000000
Padding String:

Best Regards,
News Reader

Posted by Heath Roberts on April 17, 2008, 4:11 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> Heath Roberts wrote:
> > For example, let's say I want to allow 3DES but not DES. Can I do
> > that? I don't see any options in the IOS Security Configuration Guide
> > or Reference, or in the O'Reilly IOS Cookbook...
>
> > Thanks in advance,
> > Heath
>
> You have control over the version of SSH used on the Cisco device. e.g.:
> ip ssh version 2
>
> I just did a capture and found the following on the Server Key Exchange
> which suggests that the SSHv2 on my device, doesn't support single DES:
>
> Take a look and see if you agree:
>
> SSH Protocol
> =A0 =A0 =A0SSH Version 2
> =A0 =A0 =A0 =A0 =A0Packet Length: 276
> =A0 =A0 =A0 =A0 =A0Padding Length: 4
> =A0 =A0 =A0 =A0 =A0Key Exchange
> =A0 =A0 =A0 =A0 =A0 =A0 =A0Msg code: Key Exchange Init (20)
> =A0 =A0 =A0 =A0 =A0 =A0 =A0Algorithms
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0Cookie: A19351FD6DAA335B5A7EED46E647C9F=
B
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0kex_algorithms length: 26
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0kex_algorithms string: diffie-hellman-g=
roup1-sha1
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0server_host_key_algorithms length: 7
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0server_host_key_algorithms string: ssh-=
rsa
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0encryption_algorithms_client_to_server =
length: 41
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0encryption_algorithms_client_to_server =
string:
> aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0encryption_algorithms_server_to_client =
length: 41
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0encryption_algorithms_server_to_client =
string:
> aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0mac_algorithms_client_to_server length:=
43
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0mac_algorithms_client_to_server string:=

> hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0mac_algorithms_server_to_client length:=
43
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0mac_algorithms_server_to_client string:=

> hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0compression_algorithms_client_to_server=
length: 4
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0compression_algorithms_client_to_server=
string: none
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0compression_algorithms_server_to_client=
length: 4
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0compression_algorithms_server_to_client=
string: none
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0languages_client_to_server length: 0
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0languages_server_to_client length: 0
> =A0 =A0 =A0 =A0 =A0 =A0 =A0Payload: 0000000000
> =A0 =A0 =A0 =A0 =A0 =A0 =A0Padding String:

Thanks. Restricting to v2 had occurred to me, since I don't think DES
is typically included, but I don't see that formally spelled out
anywhere, and I would prefer more positive control--what would we do
if one of the other protocols is broken in the near future?

Any other options folks can think of?

Similar ThreadsPosted
restrict cisco ping mibs by snmp-server command July 20, 2004, 11:17 pm
restrict cisco ping mibs by snmp-server command July 20, 2004, 11:17 pm
not accept sticky command March 22, 2006, 3:53 pm
Do all service providers accept /24's via BGP? March 6, 2007, 9:46 pm
Cisco 2811 router - can it accept WIC-1DSU-T1? April 19, 2007, 9:40 am
Cisco VPN Gateway: simultaneously accept IKE and forward it to another GW inbound, on same public IP address September 6, 2006, 3:40 pm
Restrict By MAC address July 12, 2005, 6:29 pm
PIX - restrict services September 21, 2006, 2:24 am
To restrict the access via MAC addresses. January 5, 2005, 11:41 am
restrict from designated MAC address January 11, 2006, 11:58 pm

other useful resources:
The Federal Communications Commission (FCC)
Telecommunications Industry Association
Electronic and Software Security Products and Services
International Telecommunication Union

Custom CGI Perl and PHP programming by 1-Script.com

Contact Us | Privacy Policy
The site map in XML format XML site map