ssh ciphers issue JIRA and Confluence

Navadeep August 1, 2017

Hi ,

We have successfully migrated and upgraded JIRA and Confluence applications to latest versions. JIRA(7.4.1) and Confluence(6.2.4) in DEV Environment.

We have not used a secure connection(https) as we are in DEV environment.

After the applications were successfully upgraded to the latest available versions, we need to have a scan of the application servers by the network team here.

Below is the response from our network team after the security scan of the JIRA and Confluence application servers.

#############################################################

The following ssh ciphers were marked as an issue:
 
  • arcfour
  • arcfour128
  • arcfour256
I have personally never seen these ciphers before and they have never come up on any scans we have done in the past so it could be something that the application setup which needs to be verified because if that is not the case I will need to remove them. If the application did install them than we need a validation of why they are required which will have to be signed off by security.

#############################################################

Thanks,

Nav

2 comments

Daniel Eads _unmonitored account_
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
August 1, 2017

Hi Nav,

JIRA/Confluence installs don't modify openssh. Those ciphers weren't enabled or modified by Atlassian applications, so you should be able to disable them without adversely affecting your application installs.

I can't advise you specifically on how to disable those ciphers as I don't know what distribution you're running, but it should be easy enough to Google for your distribution + "disable arcfour cipher".

Good luck!

Nic Brough -Adaptavist-
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
August 1, 2017

It's not clear what was tested here.  If you're just using JIRA and Confluence on http though, it could not have been them.

For most ssh daemons, look in the sshd_config , found typically in /etc/ssh/ .   You should probably check ssh_config while you're there too.

If it is the JIRA/Confluence you need to check, then you will either need to look at the proxy you have in front of them, or the Tomcat "connector" settings in server.xml

Comment

Log in or Sign up to comment
TAGS
AUG Leaders

Atlassian Community Events