Resolving SHA-1 Related SSH Vulnerabilities for AVI Controller

Products

• VMware Avi Load Balancer

Issue/Introduction

• An enterprise security team might report a vulnerability related to the use of SHA-1 in the SSH connections to the AVI controller.
• If the reported vulnerability involves ciphers or HMACs such as 'hmac-sha1', these can be removed via the AVI UI. Relevant steps for this are detailed in the official VMware Avi Load Balancer administration guide https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/31-1/vmware-avi-load-balancer-administration-guide/access-settings/securing-management-ip-access.html
• However, there are scenarios where the SHA-1 vulnerability is reported for the host key algorithm, which requires a different approach.

Environment

• VMware Avi Load Balancer 22.1.x and 30.2.x

Cause

• The default AVI controller configuration adopts the default host key and key exchange algorithms supported by the OpenSSH implementation.
• This configuration includes a few weaker algorithms for backward compatibility with older clients and servers.
• Some of these algorithms use SHA-1 as part of their cryptographic process, which is no longer considered secure.

Resolution

Workaround:

• If you are certain that the AVI controller does not need to communicate with any older clients or servers via SSH, you can exclude specific host key and key exchange algorithms from the configuration.
• Execute the following commands on the controller CLI to exclude these algorithms:

configure systemconfiguration
host_key_algorithm_exclude ssh-rsa
kex_algorithm_exclude diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
save

• These algorithms use SHA-1 during the key exchange process and are considered less secure compared to newer algorithms using SHA-2
• The permanent fix is to upgrade the AVI controller firmware to version 31.1.1 or later. The OpenSSH version used starting from 31.1.1 disables SHA-1 support by default, improving the overall security posture.