LogJam hardening OpenSSH and testing it

Question

I would like to harden my OpenSSH (clientsite) after the LogJam attack.

I read this article https://weakdh.org/sysadmin.html and there is one paragraph, which says how to do that. Is this enough and how can I test if that is good enough? How can I hardening it if I am using OpenSSH lower than 6.5?

but it only says how I can harden OpenSSH 6.5 or higher. Whats about Ubuntu 12.04 or Debian-Jessie or Squeed? For example how I can harden the MACs if I am not using OpenSSH 6.5, this article doesn't deal with lower versionshttps://stribika.github.io/2015/01/04/secure-secure-shell.html — Loretta, Jun 29 '15 at 11:32
LogJam affects SSL/TLS not SSH. So following their guidance to strengthen your SSH parameters should be sufficient. — RoraΖ, Jun 29 '15 at 11:34
dupe should be removed from this IMO, since this deals specifically with OpenSSH. it took me a 100 different phrasings of the problem to find this post with google. — r3wt, Dec 15 '15 at 23:41
@r3wt I think I can see your point, but the answers will look very similar, and an answer on the dupe answers this question. There is also an accepted answer to this question. — schroeder, Dec 16 '15 at 00:07

score 12 · Accepted Answer · edited Jun 16 '20 at 09:49

Throw out < 2048 bit builtin moduli

On the server: Have a look at your sshd_config and throw out the diffie-hellman-group1-sha1 if it appears in the KexAlgorithms section.

And restart SSHD.

Check with Nmap

how can I test if that is good enough?

Get Nmap and run the `ssh2-enum-algos' script against the SSH server.

The diffie-hellman-group1-sha1 must not appear. It only has 1024 bit.

Throw out < 2048 bit custom moduli

On the server: throw out DH-moduli less than 2048 bits.

Here's some code. It' adapted from a ServerFault question:

awk '$5 >= 2048' /etc/ssh/moduli > /etc/ssh/moduli.strong && \
mv /etc/ssh/moduli.strong /etc/ssh/moduli

And restart SSHD.

Check With SSH-Weak-DH Tool

Get, compile, and run the SSH weak Diffie-Hellman group identification tool. The tool uses a patched OpenSSH client that attempts various times to connect to the server using different DH group parameters for the DH key exchange protocol, thereby determining whether the server has weak DH groups enabled. GDSSecurity explains how the tool works on their blog.

Check with WireShark

I don't really know how to check for this.

Some ideas below:

Sniff the Handshake on the client with WireShark. Filter for ssh. Find the Server: Diffie-Hellman Key Exchange Reply, New Keys line.

Or quicker yet: Filter directly for ssh.message_code == 31.

Look inside the SSH Protocol | SSH Version 2 | Key Exchange | KEX DH host key section. There is human readable ASCII text in there that will tell you what Key Exchange mechanism the server has selected. If it's something that starts with ecdsa- then you're safe from LogJam. Otherwise you'll have to have to count bytes again. And there'll have to be at least 256. (256 x 8 bits == 2048 bits. Which is what we want as a minimum key length.)

Further reading:

Jethro Beekman, 2015-05-20, On OpenSSH and Logjam (Archived here.)
stribika, 2015-01-04, Secure Secure Shell (Archived here.)