Scan of new deployment

[tommorgan365]

Distributed environment
manager
two search nodes
one fleet.
Deployed with your ISO.

Network Scan is reporting this on fleet:
Vulnerability
ICMP timestamp response
SSH Birthday attacks on 64-bit block ciphers (SWEET32)
SSH CBC vulnerability
SSH Server Supports 3DES Cipher Suite
SSH Server Supports diffie-hellman-group1-sha1
SSH Server Supports Weak Key Exchange Algorithms
TCP timestamp response

[TOoSmOotH]

ssh should be the latest and try and update every 15 minutes. Can you do a rpm -qa | grep ssh?

[B3DTech]

Thanks for the follow up - the post/documentation came across very indignant.

[tommorgan365]

Meanwhile -- my question was ICMP timestamp looks like it needs to be done at the firewall level at the fleet machine. Any guidance on this one - read through firewall doc and want to be careful.

[dougburks]

We're not being indignant. We're simply trying to respond to as many questions and problems as quickly as possible given our limited resources. Thanks for your understanding.

[TOoSmOotH]

Meanwhile -- my question was ICMP timestamp looks like it needs to be done at the firewall level at the fleet machine. Any guidance on this one - read through firewall doc and want to be careful.

I have put in a new issue #1704 for the ICMP thing.

[dougburks]

We've made some updates to https://docs.securityonion.net/en/2.3/ssh.html. As always, please keep in mind that documentation is a work in progress.