0

I am running 389-DS on CentOS. Version - '389-ds-base.i686 1.2.11.15-34.el6_5'. Security scans revealed that NullCiphers were found on Port 389 and 636.

I tried to disable them by shutting down DS, editing the 'nsSSL3Ciphers' on all '/etc/dirsrv/slapd-/dse.ldif' files, and starting DS. nsSSL3Ciphers looks like this now -

modifyTimestamp: 20140915221826Z
nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5,
 +rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+fortezza,+fo
 rtezza_rc4_128_sha,-fortezza_null,+tls_rsa_export1024_with_rc4_56_sha,+tls_rs
 a_export1024_with_des_cbc_sha
numSubordinates: 1

Scans are still showing Null Cipher on those 2 ports.

Here is the list of null SSL ciphers supported by the remote server :
  Null Ciphers (no encryption)
    TLSv1
      NULL-SHA                     Kx=RSA         Au=RSA      Enc=None                 Mac=SHA1   
The fields above are :
  {OpenSSL ciphername}
Port
389 / tcp / ldap    
636 / tcp / ldap    

Any ideas on how i can disable these Null ciphers?

2 Answers 2

1

You can either fix the ciphers manually as suggested in other answer or, when applicable, simply upgrade to FreeIPA 4.0.3 which fixes the ciphers out of the box (upstream ticket).

This is what I get with FreeIPA 4.0.3 or 4.1.0 Alpha1:

# nmap --script ssl-cert,ssl-enum-ciphers -p 636 `hostname`

Starting Nmap 6.40 ( http://nmap.org ) at 2014-10-09 01:52 EDT
Nmap scan report for ipa.mkosek-rhel71.test (10.16.78.57)
Host is up (0.000092s latency).
PORT    STATE SERVICE
636/tcp open  ldapssl
| ssl-cert: Subject: commonName=ipa.mkosek-rhel71.test/organizationName=MKOSEK-RHEL71.TEST
| Issuer: commonName=Certificate Authority/organizationName=MKOSEK-RHEL71.TEST
| Public Key type: rsa
| Public Key bits: 2048
| Not valid before: 2014-10-09T04:52:15+00:00
| Not valid after:  2016-10-09T04:52:15+00:00
| MD5:   0fc7 afd6 343b 9e51 abd0 3ba1 7bde 3c25
|_SHA-1: 246a 02f2 1663 3ca9 e97b cdd4 887e 6e10 7685 5627
| ssl-enum-ciphers: 
|   TLSv1.2: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - strong
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - strong
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_RSA_WITH_AES_128_CBC_SHA256 - strong
|       TLS_RSA_WITH_AES_128_GCM_SHA256 - strong
|       TLS_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_AES_256_CBC_SHA256 - strong
|       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong
|       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong
|       TLS_RSA_WITH_SEED_CBC_SHA - strong
|     compressors: 
|       NULL
|_  least strength: strong

Nmap done: 1 IP address (1 host up) scanned in 0.91 seconds
3

You would have to use an LDAP browser such as Apache Directory Studio to modify your configuration or the built-in LDAP utility ldapmodify. I will outline the steps to use ldapmodify, since it will help it make sense if you opt to use a UI tool.

To use ldapmodify, you first create an ldif file that has a specific syntax and then import it. Note that the file has "replace:" sprinkled through it. This specific example is modifying things in cn=encryption,cn=config which you could also view and modify with an LDAP browser. The file would look something like this:

dn: cn=encryption,cn=config
changetype: modify
replace: nsSSL3
nsSSL3: off
-
replace: nsSSL2
nsSSL2: off
-
replace: nsSSL3Ciphers
nsSSL3Ciphers: nsSSL3Ciphers: -rc4,-rc4export,-rc2,-rc2export,-des,-desede3,-rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,+rsa_fips_3des_sha,+fips_3des_sha,-rsa_fips_des_sha,-fips_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,-tls_rsa_export1024_with_rc4_56_sha,-rsa_rc4_56_sha,-tls_rsa_export1024_with_des_cbc_sha,-rsa_des_56_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-dhe_dss_des_sha,+dhe_dss_3des_sha,-dhe_rsa_des_sha,+dhe_rsa_3des_sha,+tls_rsa_aes_128_sha,+rsa_aes_128_sha,+tls_dhe_dss_aes_128_sha,+tls_dhe_rsa_aes_128_sha,+tls_rsa_aes_256_sha,+rsa_aes_256_sha,+tls_dhe_dss_aes_256_sha,+tls_dhe_rsa_aes_256_sha,+tls_dhe_dss_1024_rc4_sha,+tls_dhe_dss_rc4_128_sha

You would apply the file to your LDAP server like this:

ldapmodify -x -D "cn=directory manager" -W -f no_null_cipher.ldif

I can't say if these exact commands will work with your specific setup, but this will get you on the right track. Your schema could be different so cn=encryption,cn=config might not be where to make the changes. Just be super careful and if possible test what you are doing thoroughly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .