IV98623: CISCO ISO UPDATES RESTRICTED CURRENT TELNET_D_HELPER FROM REACHING DEVICES DUE TO CHANGES IN CIPHER SET FOR SSH.

4.2.0-TIV-ITNMIP-zLinux-FP0004
4.2.0-TIV-NOIHD-zLinux-FP0004
4.2.0-TIV-ITNMIP-AIX-FP0004
4.2.0-TIV-ITNMIP-Linux-FP0004
4.2.0-TIV-NOIHD-AIX-FP0004
4.2.0-TIV-NOIHD-Linux-FP0004

APAR status

• Closed as program error.

Error description

• Unable to reach various Cisco device after an ISO Cisco update
  which changes current Ciphers which were using CBC ciphers for
  SSH  and are now set to use aes128-ctr aes192-ctr aes256-ctr.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * ITNM all users                                               *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * All users with previous versions of the software are         *
  * affected if the network contains devices we are trying to    *
  * retrieve information from via command line interface (CLI)   *
  * which only support the AES-<n>-CTR algorithms and not our    *
  * current supported algotihms 3DES-CBC and AES-128-CBC.        *
  *                                                              *
  * Problem is that the ncp_dh_telnet helper does not support    *
  * the aes-128-ctr, aes192-ctr or aes-256-ctr algorithms. When  *
  * these algorithms are required by the device we are unable to *
  * connect to it and hence the telnet helper is unable to       *
  * retrieve command line interface (CLI) data. The result of    *
  * that is the various telnet agents are unable to retrieve the *
  * required data. This results in missing topology and device   *
  * data for the affected devices                                *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * The following fixpacks will contain the fix:                 *
  * | fix pack | 3.9.0-ITNMIP-FP0006                             *
  * | fix pack | 4.2.0-ITNMIP-FP0004                             *
  * | fix pack | 4.1.1-ITNMIP-FP0003                             *
  ****************************************************************
  

Problem conclusion

• The issue doesn't affect the majority of customers as support
  for the DES3-CBC and AES128-CTR algorithms is required by the
  SSHv2 protocol definition. This situation only occurred where
  for security reasons the customer had explicitly disabled those
  algorithms in his network equipment.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TIV NETWK MGR I

• Fixed component ID

  5724S4500

Applicable component levels

• R390 PSN

     UP

• R390 PSY

     UP

• R411 PSN

     UP

• R411 PSY

     UP

• R420 PSN

     UP

• R420 PSY

     UP