AW: audit perspective: proof that all connections are encrypted

• Previous message: David Wolever: "ssh -R only listening on lo"
• In reply to: Florin Andrei: "audit perspective: proof that all connections are encrypted"
• Next in thread: Mark Senior: "RE: audit perspective: proof that all connections are encrypted"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: <secureshell@securityfocus.com>
Date: Fri, 16 Sep 2005 07:31:10 +0200

Hi Florin

As i think of, sshd only allows encrypted connections! If the client
doesn't accept any specified encryption, connection is being cancelled
and not continued unencrypted. So in the other direction, there's no
config item to say "allow unencrypted connections in case of
handshake-failure" since success is a must to the protocol.

Watch man sshd_config:
     Ciphers
             Specifies the ciphers allowed for protocol version 2.
Multiple
             ciphers must be comma-separated. The default is

               ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
 
aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr''

This way you could specify the allowed (and this way enforced)
encryption algorithms...

GrEeZ!

+-------------------------------+ +-------------------------------+
| Miro Dietiker | | MD Systems Miro Dietiker |
| Dipl. Ing. FH Elektrotechnik | | Alte Zürcherstrasse 10 |
| | | 8903 Birmensdorf |
| | | |
| Mobile: +41 (0)78 707 30 10 | | Geschäft: +41 (0)43 344 03 56 |
| | | Fax: +41 (0)43 344 03 57 |
| m.dietiker@md-systems.ch | | info@md-systems.ch |
| | | www.md-systems.ch |
+-------------------------------+ +-------------------------------+

-----Ursprüngliche Nachricht-----
Von: Florin Andrei [mailto:florin@andrei.myip.org]
Gesendet: Freitag, 16. September 2005 01:06
An: secureshell@securityfocus.com
Betreff: audit perspective: proof that all connections are encrypted

I have what's perhaps a slightly unusual question.

Suppose company X is going through an audit (think: SOX). Suppose one of
the questions that the auditors ask is: "we want proof that all your
remote access devices only allow encrypted connections, not plaintext".

With a VPN concentrator, that's easy: you show them the encryption
algorithms that are enabled, show them that plaintext is a disabled
option and they're happy.

But how about openssh? Which is the config item in sshd_config that says
"if the client does not agree with all these encryption schemes, all of
which are not plaintext, terminate the connection"?

Essentially, we have to prove that plaintext is rejected by the server.

Any connection with the Ciphers and MACs options in sshd_config?

Hopefully I'm making myself understood. This is not a strictly technical
question, it's somewhere on the border between technical issues and
legal issues. I need an answer that will satisfy people who are not
geeks - if I'm being sent in the right direction I can build a coherent
response myself (hopefully) but I need a starting point.

I believe that this kind of issue will become more common in the near
future, as the practice of auditing will extend to more and more
companies.

Thanks,

-- 
Florin Andrei
http://florin.myip.org/

• Previous message: David Wolever: "ssh -R only listening on lo"
• In reply to: Florin Andrei: "audit perspective: proof that all connections are encrypted"
• Next in thread: Mark Senior: "RE: audit perspective: proof that all connections are encrypted"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]