IBM Bluemix Develop in the cloud at the click of a button!

Start building for free

IBM developerWorks / Developer Centers

Sign in / Register

dW Answers
Search

Tags

Spaces

More

Ask a question

Search tips

FAQ: How do I disable Cipher Block Chaining

(CBC) Mode Ciphers and Weak MAC Algorithms in
SSH in IBM PureData System for Operational
Analytics
Question by Alvin BL Koh | Apr 21 at 02:02 AM
FAQ

P DO A

SSH

CI P HE RS

CBC

S S HD_ CO NFI G

Follow this
question
Follow
25 people are following this
question.

You may have run a security scan or your auditor may have highlighted
the following SSH vulnerabilities and you would like to address them.
SSH Server CBC Mode Ciphers Enabled
SSH Weak MAC Algorithms Enabled

The default /etc/ssh/sshd_config file may contain lines similar to the

ones below:
open in browser PRO version

Are you a developer? Try out the HTML to PDF API

pdfcrowd.com

# default is aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,ar
cfour128,
# aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
# aes256-cbc,arcfour

Answers
Answers & comments

# default is hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96
,hmac-md5-96

To disable CBC mode ciphers and weak MAC algorithms (MD5 and -96),
add the following lines into the /etc/ssh/sshd_config file.

Related questions
FAQ: Why do db2_all or rah
show error "mesg: 0803-003
Cannot find the terminal" on

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour
128
MACs hmac-sha1,umac-64@openssh.com,hmac-ripemd160

a PureData System for

Operational Analytics or IBM
Smart Analytics System for
AIX

Restart ssh after you have made the changes.

1 Answ er

stopsrc -s sshd

Can we use an SSH git url?

startsrc -s sshd

2 Answ ers

You can test the new configuration using

How do I access WLM

(Workload Manager) from

ssh -vvv -F

DPM (Database
Performance Monitor) in

You can create a temporary configuration file to test the changes

included before implementing them in /etc/ssh/sshd_config.
The example below uses a temporary configuration file
open in browser PRO version

Are you a developer? Try out the HTML to PDF API

PDOA?
1 Answ er
MQA - RTC Integration. Too
pdfcrowd.com

/etc/ssh/sshd_config_tmp to test the changes against the HMC server

using hscroot user.
$ ssh -vvv -F /etc/ssh/sshd_config_tmp hscroot@172.23.1.8
OpenSSH_6.0p1, OpenSSL 0.9.8y 5 Feb 2013
debug1: Reading configuration data /etc/ssh/sshd_config_tmp
debug3: cipher ok: aes128-ctr [aes128-ctr,aes192-ctr,aes256
-ctr,arcfour256,arcfour128]

MQA - RTC Integration. Too

many project areas to select
from
1 Answ er
Can I create a custom URL
for my app?
1 Answ er

debug3: cipher ok: aes192-ctr [aes128-ctr,aes192-ctr,aes256

-ctr,arcfour256,arcfour128]
debug3: cipher ok: aes256-ctr [aes128-ctr,aes192-ctr,aes256
-ctr,arcfour256,arcfour128]
debug3: cipher ok: arcfour256 [aes128-ctr,aes192-ctr,aes256
-ctr,arcfour256,arcfour128]
debug3: cipher ok: arcfour128 [aes128-ctr,aes192-ctr,aes256
-ctr,arcfour256,arcfour128]
debug3: ciphers ok: [aes128-ctr,aes192-ctr,aes256-ctr,arcfo
ur256,arcfour128]
debug2: mac_setup: found hmac-sha1
debug3: mac ok: hmac-sha1 [hmac-sha1,umac-64@openssh.com,hm
ac-ripemd160]
debug2: mac_setup: found umac-64@openssh.com
debug3: mac ok: umac-64@openssh.com [hmac-sha1,umac-64@open
ssh.com,hmac-ripemd160]
debug2: mac_setup: found hmac-ripemd160
debug3: mac ok: hmac-ripemd160 [hmac-sha1,umac-64@openssh.c
om,hmac-ripemd160]
debug3: macs ok: [hmac-sha1,umac-64@openssh.com,hmac-ripemd

open in browser PRO version

Are you a developer? Try out the HTML to PDF API

pdfcrowd.com

160]

Like Comment

1 reply Add your answer

Sort:

Answer by DebbieE | Oct 28 at 12:43 PM

Thanks @Alvin BL Kohn for the info/answer above.

Like Comment Share

Your
answer

open in browser PRO version

Are you a developer? Try out the HTML to PDF API

pdfcrowd.com

Fill in the details...

Hint: You can notify a user about this post by typing @username.

Post answer

FAQ

REPORT ABUSE

T ERM S OF USE

T HIRD PART Y NOT ICE

IBM PRIV ACY

Powered by AnswerHub

open in browser PRO version

Are you a developer? Try out the HTML to PDF API

pdfcrowd.com