MOVEit Cloud SSH Host Key Cipher Changes

Incident Report for Progress MOVEit Cloud

Monitoring

Progress implemented changes to the SSH services on all MOVEit Cloud Clusters yesterday, to offer SSH host keys and algorithms that meet current security best-practice and compliance standards. These changes are essential to maintaining the security of our offering and compliance with security standards like PCI, HIPAA, and SOC2.

In preparation for these changes, customers will need to ensure that their SSH clients support the following:

* Host key algorithms: rsa-sha2-256, rsa-sha2-512, and/or ssh-ed25519
* Key Exchange (KEX) algorithms: curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512

Changes made during the April 14th maintenance window:

* Disabled ssh-rsa host key algorithm
* Disabled diffie-hellman-group-exchange-sha256 kex algorithm
* Add ed25519 server host key and ssh-ed25519 host key algorithms (this will present a new ED key for users to accept)

Here is our kb on what ciphers and exchanges we support on MOVEit Cloud: https://community.progress.com/s/article/Cloud-SSH-Ciphers-Key-Exchanges-and-Hashes

Posted Apr 15, 2024 - 14:54 CDT

This incident affects: North America - Cluster 1, North America - Cluster 2, North America - Cluster 3, Europe - Cluster 1, Australia - Cluster 1, and UK Cluster 1.