Network Management
How to force SSH V2 Only and disable insecure ciphers in Solarwinds SFTP server and NCM
This article informs how to explicitly allow SSH V2 only if your networking devices support that and have been configured the same and additionally on how to disable insecure ciphers when using the Solarwinds SFTP\SCP server (Free Tool) that also comes out of the box with the NCM product. This is a common request when a vulnerability scan detects a vulnerability. You may see SSH Weak MAC Algorithms Enabled, The remote SSH server is configured to allow MD5 and 96-bit MAC algorithms or The remote SSH server is configured to allow either MD5 or 96-bit MAC algorithms, both of which are considered weak.
First published date
Last published date
Overview
70658 SSH Server CBC Mode Ciphers Enabled
Synopsis
The SSH server is configured to use Cipher Block Chaining.
Description
The SSH server is configured to support Cipher Block Chaining (CBC) encryption. This may allow an attacker to recover the plaintext message from the ciphertext.
Note that this plugin only checks for the options of the SSH server and does not check for vulnerable software versions.
Solution
Contact the vendor or consult product documentation to disable CBC mode cipher encryption, and enable CTR or GCM cipher mode encryption.
71049 SSH Weak MAC Algorithms Enabled
SSH Weak MAC Algorithms Enabled
LOW Nessus Plugin ID 71049
Synopsis
The remote SSH server is configured to allow MD5 and 96-bit MAC algorithms.
Description
The remote SSH server is configured to allow either MD5 or 96-bit MAC algorithms, both of which are considered weak.
Note that this plugin only checks for the options of the SSH server, and it does not check for vulnerable software versions.
Solution
Contact the vendor or consult product documentation to disable MD5 and 96-bit MAC algorithms.
Product section
Cause
Resolution
NCM is using the following ciphers and algorithms and this list can be found within from Node Properties at the Connection Profile section:
- AES
- AES128
- AES192
- AES256
- DES
- 3DES
- BLOWFISH
- ChaCha20Poly1305
- Kex_algorithms: diffie-hellman-group-exchange-sha1,
- Diffie-hellman-group1-sha1
- Mac_algorithms: hmac-sha1-96
- Hmac-md5, none
For disabling cipher suites
- Your administrator could use a group policy or registry to disable insecure ciphers.
- Please contact Microsoft for further instructions on how to configure this across your environment.
If this is a specific server where you need to quickly mitigate
- We would usually recommend the following third party tool:
- https://www.nartac.com/Products/IISCrypto/
The NCM SSH client uses the encryption based on what is negotiated with the devices.
It makes sense therefore to not have them enabled this at the target devices so you should have already disabled them on the various devices themselves to prevent issues.
- It is important to note for those with very strict secure environments that ideally FIPS would already have been configured on the windows server if hardware is compatible from the initial deployment.
- Orion has an option to additionally utilize this FIPS setup.
- This should automatically eliminated any usage of none secure ciphers.
- It is not recommended to do this as part of upgrade, but a fresh install
Please read more about this and the requirements here:
Enable FIPS for Orion Platform products
https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Core-Enabling-FIPS-sw1508.htm
SolarWinds SFTP/SCP Server is a free tool that ships with NCM for the customer's convenience,
- Please note, you can also use a different SFTP/SCP Server if you are using SCP transfers within NCM.
- Most customers use the free tool that comes with NCM, but you do have additional options on this.
- The details to use an alternative tool can be set under Settings > All Settings > NCM Settings > SCP Server > 3rd Party section.
- Uninstall the SW SCP free tool
- Configure NCM to use the alternative tool of your choice.