Problem

How to disable the SSH Server CBC Mode Ciphers?

Our security audit solution reportes CVE-2008-5161 (rated low)

Resolution

For the SFTP server in CFT, the default cipher list is aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc.

You can remove the cbc ciphers in the list.

See parameter CIPHLIST of the CFTSSH DIRECT=SERVER

CIPHLIST = {(num, num, ..)} List of allowed ciphers (encryption methods).
Each value defines three algorithms: * Authentication algorithm

*Encryption algorithm
*Sealing algorithm

This list is compared with the list proposed by the client in order of preference, for the purpose of determining the suite to be negotiated.

Transfer CFT supports the following: aes256-ctr, aes192-ctr, aes128-ctr, aes256-cbc, aes192-cbc, aes128-cbc, 3des-cbc, blowfish-cbc.

Note
If the field is empty, the default list is: aes256-ctr, aes192-ctr, aes128-ctr, aes256-cbc, aes192-cbc, aes128-cbc.