【Problem Description】
| The remote host has IP forwarding enabled. An attacker can exploit this to route packets through the host and potentially bypass some firewalls / routers / NAC filtering. Unless the remote host is a router, it is recommended that you disable IP forwarding. |
| The SSH server is configured to support Cipher Block Chaining (CBC) encryption. This may allow an attacker to recover the plaintext message from the ciphertext. Note that this plugin only checks for the options of the SSH server and does not check for vulnerable software versions. |
| The remote SSH server is configured to allow either MD5 or 96-bit MAC algorithms, both of which are considered weak. Note that this plugin only checks for the options of the SSH server, and it does not check for vulnerable software versions. |
【Solution Description】
IP Forwarding Enabled
Synopsisin customer xlsx files: Theremote host has IP forwarding enabled. An attacker can exploit this to route packets through the host and potentially bypass some firewalls / routers / NAC filtering. Unless the remote host isa router, it is recommended that you disable IP forwarding.
Pleasenote if switch&Firewall&Router use the routing function please do notdisable it unless the device working as a L2 switch or host.
1. SSH Encryption
1) The SSH server is configured to support Cipher Block Chaining (CBC) For switch please reference bellow command to change: <HUAWEI> system-view [HUAWEI] ssh server cipher aes256_ctr aes128_ctr |
2) The remote SSH server is configured to allow either MD5 or 96-bit MAC For switch please reference bellow command to change: <HUAWEI> system-view [HUAWEI] ssh server hmac sha2_256 |
