Resolving SSH Vulnerability Scan Hits on Port 1031

Products

• VMware Smart Assurance
• Network Observability

Issue/Introduction

Security scanners (such as Tenable/Nessus) flag port 1031 on the Smarts NCM Application Server for SSH-related vulnerabilities, including:

- **SSH Server CBC Mode Ciphers Enabled** (TEN-70658)
- **SSH Weak Key Exchange Algorithms Enabled** (TEN-153953)
- **SSH Weak MAC Algorithms Enabled** (TEN-71049)

Environment

All supported Smarts NCM versions

Cause

The Smarts NCM `sshdaemon` service, which typically listens on port 1031, is configured by default to support a wide range of ciphers and algorithms for backward compatibility. This includes older CBC-mode ciphers and weak HMAC algorithms that are now considered security risks.

Resolution

To resolve these vulnerabilities, you must explicitly define a list of approved strong ciphers in the `sshdaemon` configuration file.

1. Locate the Configuration File
   The configuration used by the service is defined by the `-Dsshtools.platform` flag in the Java process:
   `<$VOYENCE_HOME>/tools/sshdaemon/conf/unix.xml` 
   
   
2. Modify the Cipher Suite
   1. Log in to the NCM Application Server as 'root'.
   2. Navigate to the configuration directory using '$VOYENCE_HOME/tools/sshdaemon/conf/'
   3. Create a backup of the existing `unix.xml` file
   4. Open `unix.xml` in a text editor (e.g., `vi`).
   5. Locate the `<Ciphers>` section and update it to include only strong ciphers.
   
       Example of strong configuration:
      
      <Ciphers>[e-mail],[e-mail],aes256-ctr</Ciphers>
      <MACs>hmac-sha2-256,hmac-sha2-512</MACs>
      
      Note: Ensure your security team approves the specific list of ciphers based on your corporate policy.
   
   
3. Restart the service running 'service ncm-sshdaemon restart'
   Alternatively, if the service is managed via vcmaster, you may need to restart the master services running `service vcmaster restart`.
   
   
4. Verify that only strong ciphers are now offered by port 1031 using `nmap` or a similar tool

Additional Information

Alternatively, if the above does not work for you, one can block port 1031 via a firewall.