How to disable TLSv1 and TLSv1.1 on Federation Port 4444 (4383832)

A security scan reports that the Foglight Management Server (FMS) Federation RMI/JRMP service on port 4444 supports TLSv1 and TLSv1.1. These protocols are deprecated and no longer recommended, with TLSv1.2 or higher advised for secure communications.

This finding is limited to the RMI/JRMP federation port and does not impact HTTPS connections on the default FMS port 8443.

How can TLSv1 and TLSv1.1 be disabled on the Federation RMI/JRMP service (port 4444)?

The Java security configuration used by the Foglight Management Server (FMS) permits TLSv1 and TLSv1.1. As the RMI/JRMP service relies on JVM TLS settings, it accepts handshake requests for these protocols, triggering security scan findings.

HTTPS connections are managed separately through Tomcat configuration and, in newer Foglight versions, TLSv1 and TLSv1.1 should already be disabled by default. For additional details, refer to KB 4288189.

Workaround

Disable TLSv1 and TLSv1.1 in the Java security configuration:

1. Backup the configuration file:
   • Windows: [FMS_HOME]/config/security/java.windows.security
   • Linux: [FMS_HOME]/config/security/java.linux.security
2. Edit the property jdk.tls.disabledAlgorithms to include TLSv1 and TLSv1.1. For example:

   Change the line:

   jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \

   To:

   jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, DH keySize < 1024, \

3. Restart the Foglight Management Server (FMS)

Note: Disabling TLSv1 and TLSv1.1 may impact connectivity to external services (such as backend databases, LDAP directories, or email servers) if those systems are not configured to support TLSv1.2 or higher.

Status

The issue has been logged as FOG-14553 and is awaiting a fix in a future release of Foglight.