Hardening SSH and API service cryptographic configurations for VAPT remediation in VMware NSX

Products

• VMware NSX

Issue/Introduction

This article provides consolidated remediation steps for security vulnerabilities identified during Vulnerability Assessment and Penetration Testing (VAPT) in VMware NSX.

CWE-327: Weak SSH Configuration
Context: The SSH daemon allowed legacy Cipher Block Chaining (CBC) modes, exposing the system to side-channel and plaintext recovery attacks.

Remediation: Restricted SSH to modern GCM ciphers and ETM algorithms to ensure strong data encryption and integrity.

CWE-326: Weak SSL/TLS Configuration
Context: The NSX Manager API (Port 443) accepted static RSA suites, which lack Perfect Forward Secrecy (PFS) and risk historical data decryption if keys are later compromised.

Remediation: Disabled static RSA suites to mandate modern ephemeral key exchanges (like ECDHE) for forward secrecy.

Symptoms: Security audits or VAPT scanners report the following vulnerabilities:

• SSH server supports weak CBC or CTR modes.
• API service (Port 443) permits insecure SSL/TLS ciphers.

Environment

• VMware NSX 4.x
• NSX Manager Cluster
• NSX Edge Nodes

Cause

Appliance defaults include legacy cryptographic settings to support older client environments, which may not align with modern enterprise hardening standards.

Resolution

I. SSH Service Hardening (CWE-327: Weak SSH Configuration)

1. Log into the NSX appliance as root.
2. Backup the configuration: cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
3. Edit /etc/ssh/sshd_config to include secure directives: 



   Ciphers [email protected],[email protected]
   MACs [email protected],[email protected] 
   KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521

4. Append Host Key algorithms for Ubuntu 20.04+ (NSX 4.x): 
   
   

   hostkeyalgorithms [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected]
   
   hostkey /etc/ssh/ssh_host_ecdsa_key
   hostkey /etc/ssh/ssh_host_ed25519_key

   

5. Restart service: systemctl restart sshd

II. API Service Hardening (Port 443) (CWE-326: Weak SSL/TLS Configuration)

1. Export current config: curl -k -X GET -u admin https://localhost/api/v1/cluster/api-service > api_config.json
2. Set "enabled": false for all CBC and static RSA ciphers in api_config.json.
   
   
3. Retain the active "_revision" value in the JSON payload to prevent modification errors.
4. Apply config: curl -k -X PUT -u admin -H "Content-Type: application/json" -d @api_config.json https://localhost/api/v1/cluster/api-service

Additional Information

Restricting SSH to GCM/ETM will block connections from legacy terminal clients.
Applying API updates triggers a restart of the reverse-proxy, causing a 60–90 second management plane blackout.

Reference links:
Disable/Enable VMware NSX Manager/Global manager Ciphers or TLS Settings
Disable weak ciphers on NSX Manager - scanning reports show "SSH Weak Message Authentication Code Algorithms"