<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;" dir="ltr">
<p><br>
</p>
<p><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">I suspect that the security scan wants to evaluate the risk of the SSH service running on the host, regardless of who can access it. By opening SSH access from the scan host
to the CCM host, the security scan can run whatever SSH tests they want to see if it's vulnerable.</span><br>
</p>
<div style="color: rgb(0, 0, 0);">
<div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif">
<p><br>
</p>
<p>Even if you block SSH access from everything except your teams subnet, the SSH server is still vulnerable. This is what the security scan typically wants to find out.</p>
<p><br>
</p>
<p>The impact of the vulnerability is reduced by your limited access, which would then give you either (a) a pass with conditions, or (b) a fail that you need to resolve.</p>
<p><br>
</p>
<p>This is just me piecing things together from your note and from my experience.</p>
<p><br>
</p>
<p>Lelio</p>
<p><br>
</p>
<p><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p></p>
<div>---</div>
<div>Lelio Fulgenzi, B.A.</div>
<div>Senior Analyst, Network Infrastructure</div>
<div>Computing and Communications Services (CCS)</div>
<div>University of Guelph</div>
<div><br>
</div>
<div>519-824-4120 Ext 56354</div>
<div>lelio@uoguelph.ca</div>
<div>www.uoguelph.ca/ccs</div>
<div>Room 037, Animal Science and Nutrition Building</div>
<div>Guelph, Ontario, N1G 2W1</div>
<p></p>
</div>
</div>
<br>
<br>
<div style="color:rgb(0,0,0)">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> cisco-voip <cisco-voip-bounces@puck.nether.net> on behalf of Asim Mekki Basheer <asim_323@hotmail.com><br>
<b>Sent:</b> Sunday, November 13, 2016 2:10 AM<br>
<b>To:</b> cisco-voip@puck.nether.ne<br>
<b>Subject:</b> [cisco-voip] SSH Access For CUCM 7.5</font>
<div> </div>
</div>
<div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Hello Everyone</p>
<p><br>
</p>
<p>we have CUCM 7.5 in our setup, this week we have security assessment for the call manager The consultant requested the below Access to The CUCM to perform scan:</p>
<p><br>
</p>
<p>1-<b><span style="font-size:12.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Cisco Call Managers and access to ports 22 and 8443.</span></b></p>
<p><b><span style="font-size:12.0pt; font-family:"Calibri",sans-serif; color:#1F497D"><br>
</span></b></p>
<p><b><span style="font-size:12.0pt; font-family:"Calibri",sans-serif; color:#1F497D"><br>
</span></b></p>
<p><b><span style="font-size:12.0pt; font-family:"Calibri",sans-serif; color:#1F497D">how can we give SSH we have only admin ACCESS for the SSH</span></b></p>
<p><b><span style="font-size:12.0pt; font-family:"Calibri",sans-serif; color:#1F497D"><br>
</span></b></p>
<p><b><span style="font-size:12.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Thanks</span></b></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>