Forum Discussion

ROlsen_280608's avatar
ROlsen_280608
Icon for Nimbostratus rankNimbostratus
Apr 06, 2018

Change weak HMAC

We've got a 5250 running 11.6.1 and the security scan pinged for Weak Ciphers and MAC's. I have been able to reset the Ciphers to 128bit or better but none of the MAC's I've tried are acceptable. When I edit the file and put hmac-sha2-256 (or 512) I get the error on exiting vi: "There were error. Continue editing(y) or discard changes(n) (y/n)". If I change the MAC back to hmac-sha1 it is accepted. So I know it is the MAC setting. I've looked and looked for anything on F5 pages about available MAC's and have found nothing that answers my questions. FYI we at limited how much we can upgrade, so hopefully it isn't a major version change.

 

What non MD5 or SHA1 macs are available or what do I have to update/upgrade to get non-MD5/SHA1 macs.

 

11.6.1
BIG-IP
security

5 Replies

  • jaikumar_f5's avatar
    jaikumar_f5
    Icon for Noctilucent rankNoctilucent
    Apr 09, 2018

    Hi,

    did you try this out please,

    tmsh modify sys sshd include "MACs "

    Caution:

    include

    Warning: Do not use this parameter without assistance from the F5 Technical Support team. The system does not validate the commands issued using the include parameter. If you use this parameter incorrectly, you put the functionality of the system at risk.

    Also happened to check on the below,

    file - /var/run/config/sshd_config

     KexAlgorithms diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
 MACS hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
 F5 - these are FIPS approved ciphers.
 Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus
    Apr 10, 2018

    It does not seem hmac-sha2-256 is available on 11.6.* at all.

     

     rpm -qa |grep ssh-server
openssh-server-4.3p2-72.el5_6.3.0.0.3

 grep MAC /var/run/config/sshd_config
 MACS hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96

 man sshd_config
...
MACs    Specifies the available MAC (message authentication code) algorithms.  The MAC algorithm is used in protocol version 2 for data integrity pro- 
tection.  Multiple algorithms must be comma-separated.  The default is “hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96”.
...

 strings /usr/sbin/sshd |grep mac
hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
hmac-sha1
macs
%s line %d: Bad SSH2 mac spec '%s'.
%s: can not init mac %s
%s: bad mac key length: %u > %d
unsupported mac %s
no matching mac found: client %s server %s
mac_compute: no key
mac_compute: mac too long
mac %s len %d
mac_init: found %s
mac_init: unknown %s
bad mac %s [%s]
mac ok: %s [%s]
macs ok: [%s]
hmac-sha1-96
hmac-md5
hmac-md5-96
hmac-ripemd160
hmac-ripemd160@openssh.com

    However, on v13.1.0.4:

     

     rpm -qa |grep ssh-server
openssh-server-6.6.1p1-31.el7.x86_64
openssh-server-sysvinit-6.6.1p1-31.el7.x86_64

 ssh -Q mac
hmac-sha1
hmac-sha1-96
hmac-sha2-256
hmac-sha2-512
hmac-md5
hmac-md5-96
hmac-ripemd160
hmac-ripemd160@openssh.com
umac-64@openssh.com
umac-128@openssh.com
hmac-sha1-etm@openssh.com
hmac-sha1-96-etm@openssh.com
hmac-sha2-256-etm@openssh.com
hmac-sha2-512-etm@openssh.com
hmac-md5-etm@openssh.com
hmac-md5-96-etm@openssh.com
hmac-ripemd160-etm@openssh.com
umac-64-etm@openssh.com
umac-128-etm@openssh.com

 grep MAC /var/run/config/sshd_config
MACS hmac-sha1

 man sshd_config
...
MACS hmac-sha1

     MACs    Specifies the available MAC (message authentication code) algorithms.  The MAC algorithm is used in protocol ver-
             sion 2 for data integrity protection.  Multiple algorithms must be comma-separated.  The algorithms that contain
             “-etm” calculate the MAC after encryption (encrypt-then-mac).  These are considered safer and their use recom-
             mended.  The default is:

                   hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,
                   umac-64-etm@openssh.com,umac-128-etm@openssh.com,
                   hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
                   hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,
                   hmac-md5-96-etm@openssh.com,
                   hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,
                   hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,
                   hmac-sha1-96,hmac-md5-96
...

    So you can either upgrade, or tighten up the acl for SSH access.