New SSH functionality in RXA library

Product Documentation

Abstract

Improved SSH functionality in the RXA library.

Content

The SSH functionality in the RXA library has been improved, to be able to work with stronger security requirements for SSH.

Prerequisites:

SDI 7.2 fix pack 6 and above.

TDI 7.1.1 fix pack 9 and above.

Java version : Java 8 SR 5 Fp 30 and above. ( Available in 7.2.0-ISS-SDIL0019-Java8-SR5-FP30 )

Details:

Following are the details for the newly supported algorithms.

New Host Key Algorithms implemented and added to default list:
rsa-sha2-256, rsa-sha2-512, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521

New Key Exchange Algorithms implemented and added to default list:
diffie-hellman-group14-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512,
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521

Encryption algorithms appended to default list:
aes192-ctr, aes256-ctr

The library will choose available algorithms during negotiation with the SSH server.

There following properties that may be used to limit the available algorithms.
   com.ibm.net.ssh.serverHostKeyAlgorithms
   com.ibm.net.ssh.kexAlgorithms
   com.ibm.net.ssh.encryptionAlgorithms
   com.ibm.net.ssh.macAlgorithms

These properties may specify a comma separated list of names. Using these properties it is possible to avoid using weak algorithms, by only listing strong algorithms. Only implemented algorithms should be specified in these properties.

The default values when the above properties are not used, are:
   Encryption algorithms: aes128-ctr, aes128-cbc, 3des-ctr, 3des-cbc, arcfour, blowfish-ctr, blowfish-cbc, aes192-ctr, aes256-ctr
   MAC algorithms: hmac-md5, hmac-sha1, hmac-sha2-256, hmac-sha2-512, hmac-md5-96, hmac-sha1-96
   Server host keys: ssh-rsa, ssh-dss, rsa-sha2-256, rsa-sha2-512, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521
   Key Exchange algorithms: diffie-hellman-group-exchange-sha256, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1,
       diffie-hellman-group1-sha1, diffie-hellman-group14-sha256, diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
       ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521

Note on server key verification:

While SSH normally verifies that the server key has the expected fingerprint, this is not done by the RXA library or the "Remote CommandLine FC" by default. To manually do this verification, the following script needs to be added in the "After Initialization" hook in the "Remote CommandLine FC".

var fingerprint = thisComponent.getFunction().getExecutor().getRXAProtocol().getHostKey();
var stored = system.getTDIProperty("RXA", "ServerFingerPrint");

if (stored == null) {
   task.logmsg("Storing new SSH server fingerprint " + fingerprint);
   system.setTDIProperty("RXA", "ServerFingerPrint", fingerprint);
   system.getTDIProperties().getPropertyStore("RXA").commit();
} else if (!stored.equals(fingerprint)) {
   task.logmsg("Unrecognized fingerprint!");
   task.logmsg("Stored fingerprint: " + stored);
   task.logmsg("Received from server: " + fingerprint);
   task.logmsg("Aborting");
   system.abortAL("Fingerprint mismatch");
}

One also needs to create a Property Store named RXA, or change the script to use the name of an existing PropertyStore. The script will first check if the property store already has a fingerprint from the remote server key. If it does not, it will store the received fingerprint. If there already is an existing fingerprint, the script verifies that it received the same fingerprint. If it did not, it will abort the AssemblyLine. This protects against spoofing attacks and similar issues. If the server has a legitimate new server key, remove the stored value from the property store, and the next time the AssemblyLine is run, the new fingerprint value will be stored.

Document Location

Worldwide

[{"Business Unit":{"code":"BU008","label":"Security"},"Product":{"code":"SSCQGF","label":"Tivoli Directory Integrator"},"Component":"Remote Execution and Access","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.2.0 Fix pack 6 and above. \n7.1.1 Fix pack 9 and above.","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Product Synonym

TDI SDI

Was this topic helpful?

Document Information

More support for:
Tivoli Directory Integrator

Software version:
7.2.0 Fix pack 6 and above. 7.1.1 Fix pack 9 and above.

Document number:
958715

Modified date:
12 July 2019

UID

ibm10958715

IBM Support

Tips