I am fixing some deviations on a windows server 2008, and in the scan results the vulnerability SSL Enabled Server Supports Medium Strength SSL Encryption Certificates/Ciphers appeared in port 7756. The application that is running in that port is kntcma(Tivoli Monitoring agent). I tried to fix this by going to TEMS->Advanced->Edit variables and add the next lines:
GSK_PROTOCOL_SSLV2=OFF
GSK_PROTOCOL_SSLV3=ON
GSK_V3_CIPHER_SPECS="350A"
Then I restarted the agent and thought that would be enough to solve the vulnerability, but it didn't. The deviation continues to appear and I don't know what else to do to fix it
You can use certificates... here are some steps to recreate the security certificates:
C:\\IBM\\ITM\\InstallITM\\GetGSKitHome.bat
-> add the output at the beginning of the PATH
example:
set PATH=C:\\IBM\\ITM\\GSK7;C:\\IBM\\ITM\\GSK7\\lib;C:\\IBM\\ITM\\GSK7\\bin;%PATH%
C:\\IBM\\ITM\\InstallITM\\GetJavaHome.bat
-> set the output of this command as the JAVA_HOME
example:
set JAVA_HOME=C:\\IBM\\ITM\\java\\java50\\jre
on 32 bits servers where only gsk7capicmd utility is available:
set PATH=C:\\IBM\\ITM\\GSK7;C:\\IBM\\ITM\\GSK7\\lib;C:\\IBM\\ITM\\GSK7\\bin;%PATH%
gsk7capicmd.exe -cert -delete -db C:\\IBM\\ITM\\keyfiles\\keyfile.kdb -pw IBM61TIV -label "IBM_Tivoli_Monitoring_Certificate"
on 32 bits servers where gsk8capicmd utility is available:
set PATH=C:\\IBM\\ITM\\GSK8;C:\\IBM\\ITM\\GSK8\\lib;C:\\IBM\\ITM\\GSK8\\bin;%PATH%
gsk8capicmd.exe -cert -delete -db C:\\IBM\\ITM\\keyfiles\\keyfile.kdb -pw IBM61TIV -label "IBM_Tivoli_Monitoring_Certificate"
on 64 bits servers where only gsk7capicmd_64 is available:
set PATH=C:\\IBM\\ITM\\GSK7_x64;C:\\IBM\\ITM\\GSK7_x64\\lib64;C:\\IBM\\ITM\\GSK7_x64\\bin;%PATH%
gsk7capicmd_64.exe -cert -delete -db C:\\IBM\\ITM\\keyfiles\\keyfile.kdb -pw IBM61TIV -label "IBM_Tivoli_Monitoring_Certificate"
on 64 bits servers where gsk8capicmd_64 is available:
set PATH=C:\\IBM\\ITM\\GSK8_x64;C:\\IBM\\ITM\\GSK8_x64\\lib64;C:\\IBM\\ITM\\GSK8_x64\\bin;%PATH%
gsk8capicmd_64.exe -cert -delete -db C:\\IBM\\ITM\\keyfiles\\keyfile.kdb -pw IBM61TIV -label "IBM_Tivoli_Monitoring_Certificate"
on 32 bits servers where only gsk7capicmd utility is available:
set PATH=C:\\IBM\\ITM\\GSK7;C:\\IBM\\ITM\\GSK7\\lib;C:\\IBM\\ITM\\GSK7\\bin;%PATH%
gsk7capicmd.exe -cert -create -db C:\\IBM\\ITM\\keyfiles\\keyfile.kdb -pw IBM61TIV -size 4096 -dn "CN=IBM Tivoli Monitoring Self-Signed Certificate,O=IBM Tivoli,C=US" -label "IBM_Tivoli_Monitoring_Certificate" -default_cert yes -expire 3652 -sigalg sha1
on 32 bits servers where gsk8capicmd utility is available:
set PATH=C:\\IBM\\ITM\\GSK8;C:\\IBM\\ITM\\GSK8\\lib;C:\\IBM\\ITM\\GSK8\\bin;%PATH%
gsk8capicmd.exe -cert -create -db C:\\IBM\\ITM\\keyfiles\\keyfile.kdb -pw IBM61TIV -size 4096 -dn "CN=IBM Tivoli Monitoring Self-Signed Certificate,O=IBM Tivoli,C=US" -label "IBM_Tivoli_Monitoring_Certificate" -default_cert yes -expire 3652 -sigalg sha1
on 64 bits servers where gsk7capicmd_64 utility is available:
set PATH=C:\\IBM\\ITM\\GSK7_x64;C:\\IBM\\ITM\\GSK7_x64\\lib64;C:\\IBM\\ITM\\GSK7_x64\\bin;%PATH%
gsk7capicmd_64.exe -cert -create -db C:\\IBM\\ITM\\keyfiles\\keyfile.kdb -pw IBM61TIV -size 4096 -dn "CN=IBM Tivoli Monitoring Self-Signed Certificate,O=IBM Tivoli,C=US" -label "IBM_Tivoli_Monitoring_Certificate" -default_cert yes -expire 3652 -sigalg sha1
on 64 bits servers where gsk8capicmd_64 utility is available:
set PATH=C:\\IBM\\ITM\\GSK8_x64;C:\\IBM\\ITM\\GSK8_x64\\lib64;C:\\IBM\\ITM\\GSK8_x64\\bin;%PATH%
gsk8capicmd_64.exe -cert -create -db C:\\IBM\\ITM\\keyfiles\\keyfile.kdb -pw IBM61TIV -size 4096 -dn "CN=IBM Tivoli Monitoring Self-Signed Certificate,O=IBM Tivoli,C=US" -label "IBM_Tivoli_Monitoring_Certificate" -default_cert yes -expire 3652 -sigalg sha1
You can find more information at this link .
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.