Disabling cipher suites or protocols

[Matthias]

We are running Fisheye 4.6.1 and I try to disable weak ciper suites.

My config.xml has the following section :

<web-server site-url="https://crucible.xxxxxxxx.dom">
<http bind="0.0.0.0:8060" proxy-port="443" proxy-scheme="https" proxy-host="crucible.xxxxxxxxx.dom"/>
<ssl bind=":6443" keystore="/srv/crucible/keystoreneu.kst" keystore-password="xxxxxxxxxxx" truststore="/srv/crucible/keystoreneu.kst" truststore-password="xxxxxxxxx">
<excludeProtocols>
<protocol>SSLv3</protocol>
<protocol>TLSv1</protocol>
<protocol>TLSv1.1</protocol>
</excludeProtocols>
<excludeCipherSuites>
<cipherSuite>TLS_RSA_WITH_3DES_EDE_CBC_SHA</cipherSuite>
<cipherSuite>TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA</cipherSuite>
<cipherSuite>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</cipherSuite>
</excludeCipherSuites>
<proxy-info proxy-host="crucible.xxxxxxxx.dom" proxy-port="443" proxy-scheme="https"/>
</ssl>

</web-server>

A sslscan shows this :

sslscan localhost:6443
Version: 2.0.10
OpenSSL 1.1.1l 24 Aug 2021 SUSE release 150400.7.16.1

Connected to ::1

Testing SSL server localhost on port 6443 using SNI name localhost

SSL/TLS Protocols:
SSLv2 disabled
SSLv3 disabled
TLSv1.0 disabled
TLSv1.1 disabled
TLSv1.2 enabled
TLSv1.3 disabled

TLS Fallback SCSV:
Server supports TLS Fallback SCSV

TLS renegotiation:
Session renegotiation not supported

TLS Compression:
Compression disabled

Heartbleed:
TLSv1.2 not vulnerable to heartbleed

Supported Server Cipher(s):
Preferred TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve P-256 DHE 256
Accepted TLSv1.2 128 bits DHE-RSA-AES128-GCM-SHA256 DHE 1024 bits
Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve P-256 DHE 256
Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA256 DHE 1024 bits
Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA DHE 1024 bits
Accepted TLSv1.2 128 bits AES128-GCM-SHA256
Accepted TLSv1.2 128 bits AES128-SHA256
Accepted TLSv1.2 128 bits AES128-SHA
Accepted TLSv1.2 112 bits TLS_RSA_WITH_3DES_EDE_CBC_SHA
Accepted TLSv1.2 112 bits TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA

So not all excluded cipher suites work.

Kind regards

Matthias

[Martin Runge]

Hi @Matthias,

Welcome to the Atlassian community.

The protocol exclusions clearly took effect, which tells me the file is being read fine. For ciphers, I would not fight Jetty's exclude list. Two things I would try instead:

• Use a pattern rather than exact names, for example an entry matching .*_3DES_.*. Jetty treats these entries as regular expressions, so a pattern catches variants the literal names miss.
• Better: disable them at the JVM level in the Java security file of the JDK that Fisheye runs on, via jdk.tls.disabledAlgorithms. Nothing in Jetty can re-enable what the JVM refuses to offer.

You are already terminating TLS on a proxy at 443, so the other option is to control the cipher list there and keep 6443 bound to localhost only. That is usually the least painful path for a scanner finding.

One more note: your scan also shows DHE at 1024 bits, which most scanners flag as well. That one comes from the JDK version, so a Java update helps.

Fisheye 4.6.1 is quite old by now. Did you get this closed out, or has the instance moved on since?

Cheers, Martin