Forum Discussion

GeoffSweet_3221's avatar
GeoffSweet_3221
Icon for Nimbostratus rankNimbostratus
Jan 16, 2009

Disable Anonymous Authentication for SSL

I have followed a couple of posts around trying to figure out how to make this change but so far without any luck. I have a medium priority call in with F5, but I figured while I am waiting for my call back "within 8 hours" I might post this question here.

 

 

Recently we have been undergoing PCI Compliancy scans. One of the recurring issues that we have is:

 

 

------

 

SSL Server Allows Anonymous Authentication Vulnerability

 

 

The Secure Socket Layer (SSL) protocol allows for secure communication between a client and a server. The client usually authenticates the server using an

 

algorithm like RSA or DSS. Some SSL ciphers allow SSL communication without authentication. Most common Web browsers like Microsoft Internet Explorer,

 

Netscape and Mozilla do not use anonymous authentication ciphers by default.

 

A vulnerability exists in SSL communcations when clients are allowed to connect

 

using no authentication algorithm. SSL client-server communication may use several different types of

 

authentication: RSA, Diffie-Hellman, DSS or none. When 'none' is used, the

 

communications are vulnerable to a man-in-the-middle attack."

 

------

 

 

Our BigIP device hosts our SSL certificates for the load balanced sites behind it. If the certificates were directly on our Apache servers, then turning off the anonymous authentication would be trivial. However I have yet to find a solution with the BigIP. A setting? An iRule? Any help or advice would be greatly appreciated!
config
design
  • GeoffSweet_3221's avatar
    GeoffSweet_3221
    Icon for Nimbostratus rankNimbostratus
    Jan 16, 2009
    ah, well I figured it out. For our release, 9.4.3, the command is:

     

     

    bigpipe httpd sslciphersuite 'ALL:!ADH:!SSLv2:!EXPORT40:!EXP:!LOW'

     

     

    That disables low encryption and null and anonymous cipher requests.
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jan 19, 2009
    The 'b httpd' commands only modify the admin GUI configuration. If you want to specify which ciphers can be used for a LB VIP, you can modify the client SSL profile or use an iRule. Check this post for details on both methods:

     

     

    Disable SSLv2 (Click here)

     

     

    Aaron
  • swo0sh_gt_13163's avatar
    swo0sh_gt_13163
    Icon for Altostratus rankAltostratus
    Mar 30, 2015

    Surprisingly there is no help available for this vulnerability for 11.6.0 Firmware version. However I was expecting that after disabling SSLv2/TLS1 this cipher suite will be disabled, however that wasn't fact.

    I had to manually disable this particular cipher from the Client-SSL Profile.

    Profile > SSL > Client > TestClientSSL
Ciphers - HIGH:!ADH

    After updating the Client-SSL Profile, I verified the HTTPS service on Qualys and DigiCert's SSL Test site and it was fixed. I hope this would help someone.

    Cheers!

    • Venomlace_13384's avatar
      Venomlace_13384
      Icon for Nimbostratus rankNimbostratus
      Jul 15, 2015
      within my Client SSL configurations I have this for Ciphers: NATIVE:!MD5:!EXPORT:!DES:!SSLv3:!RC4:@SPEED Do I add HIGH:!ADH within there or replace the entire string with it? Thanks!
  • swo0sh_gt_13163's avatar
    swo0sh_gt_13163
    Icon for Altostratus rankAltostratus
    Jul 15, 2015

    Hello Venomlace,

    I think you can use your current cipher suites defined in your Client-SSL Profile, by adding !ADH within the same suite, to discard the ADH from being negotiate.

    You may update your current cipher suite to the following. 

    NATIVE:!MD5:!EXPORT:!DES:!SSLv3:!ADH:!RC4:@SPEED

    I hope this helps.

    Cheers! Darshan

    • Venomlace_13384's avatar
      Venomlace_13384
      Icon for Nimbostratus rankNimbostratus
      Jul 15, 2015
      Thanks much! I will test this out and see if it passes our PCI scans. I'll follow up to let you know.
  • Muhammad_64435's avatar
    Muhammad_64435
    Icon for Nimbostratus rankNimbostratus
    Sep 25, 2017

    My PCI scan also caught this Vulnerability

     

    SSL Server Allows Anonymous Authentication Vulnerability

     

    The Secure Socket Layer (SSL) protocol allows for secure communication between a client and a server. The client usually authenticates the server using an algorithm like RSA or DSS. Some SSL ciphers allow SSL communication without authentication. Most common Web browsers like Microsoft Internet Explorer, Netscape and Mozilla do not use anonymous authentication ciphers by default. A vulnerability exists in SSL communications when clients are allowed to connect using no authentication algorithm. SSL client-server communication may use several different types of authentication: RSA, Diffie-Hellman, DSS or none. When 'none' is used, the communications are vulnerable to a man-in-the-middle attack.

     

    I have changed the ciphers as follows ... solved the problem ...

     

    OLD cipher : NATIVE:!SSLv3:!MD5:!EXPORT:!DES:!DHE:!EDH:!RC4:@SPEED

     

    NEW cipher : NATIVE:!SSLv3:!MD5:!EXPORT:!DES:!DHE:!EDH:!RC4:!AES-GCM:@SPEED

     

    Following website also let you know if its been disabled or not :

     

    https://dev.ssllabs.com/ssltest/

     

    More reading : https://security.stackexchange.com/questions/113535/what-are-the-use-cases-for-anonymous-ssl-cipher-suites

     

    Thanks, mS