Return
-
Title
What message authentication codes (MAC) are supported for SSH PSM sessions? -
Description
What message authentication codes (MAC) are supported for SSH PSM sessions?
Error when attempting to open a session to Redhat/Centos 6.4 and below.SSHD debug on the target shows the error:
ddd ddd hh:mm:ss sshd[pid]: fatal: no matching mac found: client hmac-sha2-256,hmac-sha2-512 server hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
-
Cause
Redhat/Centos 6.4 and below use the default hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-sha1-96,hmac-md5-96.Redhat/Centos 6.5 adds hmac-sha2-256,hmac-sha2-512
-
Resolution
This can be resolved by enabling the missing server side message authentication codes using either the Safeguard-PS cmdlet or through the API.To add additional MAC support through Powershell:
1. Follow the installation instructions in the One Identity Safeguard PowerShell Scripting Resources page.2. Open PowerShell.3. Run "Connect-Safeguard -Appliance X.X.X.X -Insecure -Gui", replace the X's with your appliance's X0 interface IP address.4. Once connected, Run "Get-SafeguardSessionSshAlgorithms ServerSide -Verbose | Format-List", Take note of the "Mac" list.5. Run "Add-SafeguardSessionSshAlgorithm ServerSide Mac XXXX -Verbose", replace the X's with the missing cipher.This will add one of the missing algorithms, repeat this step for the remaining ciphers.6. Once completed, repeat step 4, the algorithms should now be available in the cipher list.
The following MACs are enabled by default:
- hmac-sha2-512
- hmac-sha2-256
The following MACs are supported by Safeguard:- hmac-sha1
- hmac-sha1-96
- hmac-md5
- hmac-md5-96
- hmac-sha2-256
- hmac-sha2-512