When our system is scanned by security it is coming up with weak cipher errors and points to the fact they are communicating using SSLv2. Our thought was to disable SSLv2 system wide instead of for each application as there are about 20 or so offending ports and to track down what application is on what port can be a time consuming process.
We added the registry key:
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server and set a
DWORD value to
This seems to stop some applications from using SSLv2 as port
443 but not on any other ports for instance SPLUNK
8089. Also, ports
3269 for LDAP are not using SSLv2 at all but TLS and still come up as a security finding.
Is this setting a system wide setting or does it only have an effect on Windows services? If we force applications to use SSLv3 we should be able to get past the weak cipher ding. Any ideas?