Forum Discussion

ROlsen_280608's avatar
ROlsen_280608
Icon for Nimbostratus rankNimbostratus
Apr 06, 2018

Change weak HMAC

We've got a 5250 running 11.6.1 and the security scan pinged for Weak Ciphers and MAC's. I have been able to reset the Ciphers to 128bit or better but none of the MAC's I've tried are acceptable. Whe...
11.6.1
BIG-IP
security
jaikumar_f5's avatar
jaikumar_f5
Icon for Noctilucent rankNoctilucent
Apr 09, 2018

Hi,

did you try this out please,

tmsh modify sys sshd include "MACs "

Caution:

include

Warning: Do not use this parameter without assistance from the F5 Technical Support team. The system does not validate the commands issued using the include parameter. If you use this parameter incorrectly, you put the functionality of the system at risk.

Also happened to check on the below,

file - /var/run/config/sshd_config

 KexAlgorithms diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
 MACS hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
 F5 - these are FIPS approved ciphers.
 Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc