Diego's SSH proxy uses deprecated SHA1 settings
Article ID: 377122
Updated On:
Products
Issue/Introduction
Diego-SSH uses SHA1(Secure Hash Algorithm 1), an insecure cryptographic hash. This is considered a vulnerability because it no longer provides the cryptographic security needed to prevent tampering, impersonation, and other types of cyberattacks.
https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm
“We recommend that anyone relying on SHA-1 for security migrate to SHA-2 or SHA-3 as soon as possible.” —Chris Celi, NIST computer scientist
Environment
diego_brain/0:/etc/ssh# lsof -i:2222
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh-proxy 8197 vcap 8u IPv4 39941 0t0 TCP *:2222 (LISTEN)diego_brain/0:/etc/ssh# cat /var/vcap/jobs/ssh_proxy/config/ssh_proxy.json | jq
{
"address": "0.0.0.0:2222",
"health_check_address": "0.0.0.0:2223",
"disable_health_check_server": true,
"host_key": "-----BEGIN RSA PRIVATE KEY-----redacted-----END RSA PRIVATE KEY-----\n",
"skip_cert_verify": false,
"log_level": "info",
"debug_address": "###.#.#.#:#####",
"connect_to_instance_address": false,
"communication_timeout": "10s",
"cc_api_url": "https://cloud-controller-ng.service.cf.internal:9024",
"cc_api_ca_cert": "/var/vcap/jobs/ssh_proxy/config/certs/cc/cc_api_ca_cert.crt",
"idle_connection_timeout": "300s",
"bbs_address": "https://bbs.service.cf.internal:8889",
"bbs_client_cert": "/var/vcap/jobs/ssh_proxy/config/certs/bbs/client.crt",
"bbs_client_key": "/var/vcap/jobs/ssh_proxy/config/certs/bbs/client.key",
"bbs_ca_cert": "/var/vcap/jobs/ssh_proxy/config/certs/bbs/ca.crt",
"enable_diego_auth": false,
"enable_cf_auth": true,
"uaa_ca_cert": "/var/vcap/jobs/ssh_proxy/config/certs/uaa/ca.crt",
"uaa_token_url": "https://uaa.service.cf.internal:8443/oauth/token",
"uaa_password": "####",
"uaa_username": "ssh-proxy",
"time_format": "rfc3339",
"loggregator": {
"loggregator_use_v2_api": true,
"loggregator_api_port": 3458,
"loggregator_ca_path": "/var/vcap/jobs/ssh_proxy/config/certs/loggregator/ca.crt",
"loggregator_cert_path": "/var/vcap/jobs/ssh_proxy/config/certs/loggregator/client.crt",
"loggregator_key_path": "/var/vcap/jobs/ssh_proxy/config/certs/loggregator/client.key",
"loggregator_job_deployment": "cf-###########",
"loggregator_job_name": "diego_brain",
"loggregator_job_index": "########-####-####-####-############",
"loggregator_job_ip": "###.##.###.##",
"loggregator_job_origin": "ssh_proxy",
"loggregator_source_id": "ssh_proxy",
"loggregator_instance_id": "########-####-####-####-###########"
},
"backends_tls_enabled": true,
"backends_tls_ca_certificates": "/var/vcap/jobs/ssh_proxy/config/certs/backends_tls/ca.crt",
"backends_tls_client_certificate": "/var/vcap/jobs/ssh_proxy/config/certs/backends_tls/client.crt",
"backends_tls_client_private_key": "/var/vcap/jobs/ssh_proxy/config/certs/backends_tls/client.key"
}Resolution
This issue has been resolved in TPCF 10.0.1 and higher versions, which include diego-release v2.107.0. The fix was originally introduced in diego-release v2.106.0.
To resolve this issue, please upgrade your environment to TPCF 10.0.1 or higher. There are no known workarounds for versions prior to this release.
Feedback
