How to fix the error "SSH Protocol Version 1 Session Key Retrieval"

03/26/2020 9 15057

DESCRIPTION:

PCI scan of the SonicWall UTM appliance reports the following vulnerability: "SSH Protocol Version 1 Session Key Retrieval".

RESOLUTION:

SonicWall UTM appliances uses SSH1 along with SSH2 and as of now we cannot disable SSH1 alone. But this vulnerability can be remedied using one of the following resolutions.

Resolution1: Disable SSH on the WAN iinterfaces.

Step 1: Goto Network | Interface. Click Configure icon on the WAN interface.



Step 2: Disable SSH management and click OK.

Resolution 2:  Allow SSH management access only from specific trusted source IP Addresses.

Step1: Go to Firewall | Address Object and click Add under address objects.

Step2: Enter the name for the object and enter the IP address of the computer from where you are trying to take SSH session. Select the zone as WAN.




Step3: Goto Firewall | Access Rule and select WAN > WAN rule.  You can see the SSH management rule.




Step4:  Edit the rule and select "My IP address" from the drop down list.



Note: If you want to allow multiple IP addresses, you need to create address objects and group them together in a address group. Then select the address group in the source of access rule.
 

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

SonicWall UTM appliances uses SSH1 along with SSH2 and as of now we cannot disable SSH1 alone. But this vulnerability can be remedied using one of the following resolutions.

Resolution1: Disable SSH on the WAN interfaces.

Step 1: Click Manage in the top navigation menu. Go to Network | Interfaces. Click Configure icon on the WAN interface.



Step 2: Disable SSH management and click OK.

Resolution 2:  Allow SSH management access only from specific trusted source IP Addresses.

Step1: Click Manage in the top navigation menu. Go to Objects | Address Objects and click Add under address objects.

Step2: Enter the name for the object and enter the IP address of the computer from where you are trying to take SSH session. Select the zone as WAN.




Step3: Go to Rules | Access Rules and select WAN > WAN rule.  You can see the SSH management rule.




Step4:  Edit the rule and select "My IP address" from the drop down list.



Note: If you want to allow multiple IP addresses, you need to create address objects and group them together in a address group. Then select the address group in the source of access rule.