Forum Discussion

aboulleill_3013's avatar
aboulleill_3013
Icon for Nimbostratus rankNimbostratus
Dec 08, 2017

SSL Server Allows Anonymous Authentication Vulnerability

Good morning,

 

Kindly note security scan from Qualys returned the following vulnarability "SSL Server Allows Anonymous Authentication Vulnerability" while I'm using an SSL client profile with non default cipher only "TLSv1_2" is enabled. Can somebody provide solution to close this vulnarability and disable null cipher.

 

Thanks in advance.

 

Best Regards, Ralph El Habr

 

application delivery
BIG-IP
LTM
security
  • Ashwin_Venkat's avatar
    Ashwin_Venkat
    Icon for Employee rankEmployee
    Dec 14, 2017

    That result from Qualys is pointing to the fact that you have anonymous cipher suites enabled, and with cipher string you're using, that is due to ADH being enabled.

    You can disable it by appending ':!ADH' to your existing cipher string and I'd go one step further to also disable other weaker ones like RC4, DE & 3DES. Therefore, the following cipher string disables all those weaker ones:

      TLSv1_2:!ADH:!DES:!3DES:!RC4

    Please let me know if you have any questions.