Diffie-Hellman Key Exchange insufficient DH Group strength vulnerability (4044009)

Chat now with support

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

Diffie-Hellman Key Exchange insufficient DH Group strength vulnerability
Description

The SSL/TLS service on port tcp 9443 uses Diffie-Hellman groups with insufficient strength (key size < 2048).

Resolution

Issue will be addressed in QS version 7.1.1

Workaround:

Edit the file

/opt/qorestor/bin/secure_connect/sc_server.properties

Change the line

openSSL.server.cipherList = EECDH+aRSA+AES:-AES256:FIPS:!ADH:!LOW:!EXP:!MD5:!3DES:!SEED:!RC4:!SSLv2:!SSLv3:!eNULL:!aNULL

openSSL.server.cipherList = EECDH+aRSA+AES:-AES256:FIPS:!DH:!EDH:!ADH:!LOW:!EXP:!MD5:!3DES:!SEED:!RC4:!SSLv2:!SSLv3:!eNULL:!aNULL

Restart ocards (make sure no backup job is running before taking this step)
```
service ocards restart
```

Feedback Submitted

Did this article solve an issue for you?

Select Rating