Configure SSH on the Evaluated Configuration for FIPS
SSH through remote management interface allowed in the evaluated configuration. This topic describes how to configure SSH through remote management.
The following algorithms that needs to be configured to validate SSH for FIPS.
To configure SSH on the DUT:
Specify the permissible SSH host-key algorithms for the system services.
[edit] user@host#set system services ssh hostkey-algorithm ssh-ecdsa user@host#set system services ssh hostkey-algorithm no-ssh-dss user@host#set system services ssh hostkey-algorithm ssh-rsa
Specify the SSH key-exchange for Diffie-Hellman keys for the system services.
[edit] user@host#set system services ssh key-exchange ecdh-sha2-nistp256 user@host#set system services ssh key-exchange ecdh-sha2-nistp384 user@host#set system services ssh key-exchange ecdh-sha2-nistp521
Specify all the permissible message authentication code algorithms for SSHv2
[edit] user@host#set system services ssh macs hmac-sha1 user@host#set system services ssh macs hmac-sha2-256 user@host#set system services ssh macs hmac-sha2-512
Specify the ciphers allowed for protocol version 2.
[edit] user@host#set system services ssh ciphers aes128-cbc user@host#set system services ssh ciphers aes256-cbc user@host#set system services ssh ciphers aes128-ctr user@host#set system services ssh ciphers aes256-ctr user@host#set system services ssh ciphers aes192-cbc user@host#set system services ssh ciphers aes192-ctr
Supported SSH hostkey algorithm:
ssh-ecdsa Allow generation of ECDSA host-key ssh-rsa Allow generation of RSA host-key
Supported SSH key-exchange algorithm:
ecdh-sha2-nistp256 The EC Diffie-Hellman on nistp256 with SHA2-256 ecdh-sha2-nistp384 The EC Diffie-Hellman on nistp384 with SHA2-384 ecdh-sha2-nistp521 The EC Diffie-Hellman on nistp521 with SHA2-512
Supported MAC algorithm:
hmac-sha1 Hash-based MAC using Secure Hash Algorithm (SHA1) hmac-sha2-256 Hash-based MAC using Secure Hash Algorithm (SHA2) hmac-sha2-512 Hash-based MAC using Secure Hash Algorithm (SHA2)
Supported SSH ciphers algorithm:
aes128-cbc 128-bit AES with Cipher Block Chaining aes128-ctr 128-bit AES with Counter Mode aes192-cbc 192-bit AES with Cipher Block Chaining aes192-ctr 192-bit AES with Counter Mode aes256-cbc 256-bit AES with Cipher Block Chaining aes256-ctr 256-bit AES with Counter Mode 3des-cbc Triple Data Encryption Standard in Cipher Block Chaining