How to disable SSH protocol version 1 on the Symantec Brightmail Gateway (SBG) Appliance

Article:TECH90735  |  Created: 2008-01-06  |  Updated: 2012-03-20  |  Article URL http://www.symantec.com/docs/TECH90735
Article Type
Technical Solution

Product(s)

Problem



Whilst performing a vulnerability scan against the Symantec Brightmail Gateway Appliance, an OpenSSH vulnerability is reported by the software scan tool used.


The following vulnerabilities may be reported: SSH Protocol Version 1 Supported


Cause



The Symantec Brightmail Gateway appliance supports both versions 1 and 2 of the SSH protocol by default.


Solution



SBG 7.x , 8.x :

Use the sshdver command to configure the version of the SSH protocol used by the Brightmail Gateway.

To check the SSH protocol used:

  1. Log in as admin to the Symantec Brightmail Gateway Command Line Interface.
  2. Enter the following command:
    sshdver -v



To force SSH protocol version 2:

  1. Log in as admin to the Symantec Brightmail Gateway Command Line Interface.
  2. Enter the following command to force SSH protocol 2 to be used:
    sshdver 2

SMG 9.x

 

Use the sshd-config command to configure the version of the SSH protocol used by the Messaging Gateway.

To check the SSH protocol used:

  1. Log in as admin to the Symantec Messaging Gateway Command Line Interface.
  2. Enter the following command:
    sshd-config -v



To force SSH protocol version 2:

  1. Log in as admin to the Symantec Messaging Gateway Command Line Interface.
  2. Enter the following command to force SSH protocol 2 to be used:
    sshd-config -v2





References
From Symantec Brightmail Gateway 7.6.1-14 Release Notes document:


Enhancement to support setting SSH protocol version

Due to reported vulnerabilities in SSH protocol version 1, a new CLI command has been developed, sshdver.
The sshdver command can be used to configure SSH version 2.
This command must be run manually--as making the change automatically could cause system management problems
for customers who have configured access in a manner reliant on protocol version 1.
It is highly recommended that all customers switch to using protocol version 2 exclusively, once their data center infrastructure
has been modified to support using that protocol version.
 




Legacy ID



2008110611034454


Article URL http://www.symantec.com/docs/TECH90735


Terms of use for this information are found in Legal Notices