We have RSA Authentication manager version 8.2.1 installed on three RSA hardware appliances(RSA SecureID AM8 Intel Appliance 250) and enabled SSH RSA Authentication Manager. I would like to know SSH in my RSA SecureID is using libssh or lib2ssh. If libssh is used can I upgrate to libssh2?.
Any comments for this?
Support would probably have to ask Engineering which library was used, unless there is a way in Linux to determine what library is used by an application, in this case SSH. Support usually deals in questions about Scan findings and vulnerabilities, so we do not always have a lot of information about builds, and since the RSA SecurID Authentication Manager server is considered an appliance, we do not always publish such details, and modifications to libraries used would be considered unsupported. It might work, it might not, but if some other problem is reported, Engineering may ask that the appliance be returned to its original state before troubleshooting other bugs
You could open a support case to ask this question, then see if Product Management and Engineering are willing to divulge this information
Thank you for the reply
Thank you everyone for replying.
If you are asking about CVE 2018-10933 and Suse:
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.
This issue only affects libssh from www.libssh.org, in server mode operation only, and only on SUSE Linux Enterprise 12 and 15. The libssh2 from www.libssh2.org is not affected, as it only offers client support.
RSA Authentication Manager 8.3.0.4.0 servers uses Suse 11.4
To answer your question a bit better, specifically we do not support making any changes or updates to the software outside the scope of an RSA update or patch, as these servers are 'black box implementations' and use a specially hardened operating system. Unsupported changes or updates can be problematic and prevent reliable operations or later updates.
If you have a specific security concern it is best to open a support case with the details so it can be addressed. Our security guides do specifically note to keep ssh disabled until needed, and then turn it off when not needed.
Thank you for your reply
Hello Junxia,
Our Authentication Manager doesn't use libssh nor libssh2, because our Authentication Manager implements the SSH Server using openssh (Completely independent on libssh).
This also can be verified using the following :
1- Log into your server with rsaadmin Credentials
2- Type : ssh -v localhost
And you'll see that it uses the OpenSSH Library.
Hello Junxia,
Our Authentication Manager doesn't use libssh nor libssh2, because our Authentication Manager implements the SSH Server using openssh (Completely independent on libssh).
This also can be verified using the following :
1- Log into your server with rsaadmin Credentials
2- Type : ssh -v localhost
And you'll see that it uses the OpenSSH Library.