This article describes how to remove legacy ciphers (SSL2, SSL3, DES, 3DES, MD5 and RC4) on NetScaler.

Use case

• Ramesh wishes to interact in a secure fashion (some arbitrary, some known) free from any security attack through a web browser. Recent attacks on weaker ciphers in SSL layer has rendered them useless and thus Ramesh wants to ensure that he is not using the weak ciphers.
• Banking.com wishes to host webservers to be used by people like Ramesh in a secure fashion free from any security threat.

Background

Secure transfer of data between the client and server is facilitated by Transport Layer Security(TLS)  and its predecessor  Secure Socket Layer(SSL). They are not just used by websites that use HTTP protocol, but also is utilized by wide variety of services.  Some of the services include e-mail, Chat applications, FTP applications and Virtual Private Networks (VPN). 

Choice of ciphers used has become critical as they ensure safety of data exchanged between client and server. Making a mistake in choosing ciphers would bring in a false sense of security. Intruders can successfully decrypt or gain access to sensitive information when choice of ciphers used for secure communication includes outdated ciphers which are prone to different kind of attacks.

Key points to be considered while securing SSL layer,

• SSL 2.0 and SSL 3.0 should be disabled
• Weak ciphers like DES, 3DES, RC4 or MD5 should not be used

Instructions

This article is divided into the following sections:

• Remove Legacy Ciphers that Use SSL3, DES, 3DES, MD5 and RC4
  • Remove Legacy Ciphers SSL3, DES, 3DES, MD5 and RC4 from cipher group
  • Remove Legacy Ciphers SSL3, DES, 3DES, MD5 and RC4 from SSL Profile
• Disable SSL2.0 and SSL3.0 on NetScaler
  • Disable SSL 3.0/2.0 on a vserver
  • Disable SSL 3.0/2.0 on SNIP
  • Disable SSL 3.0/2.0 on NetScaler Management Interface

Remove Legacy Ciphers that Use SSL3, DES, 3DES, MD5 and RC4

Legacy ciphers that use SSL3, DES, 3DES, MD5 and RC4 can be removed from NetScaler by two ways. They can either be removed from cipher group or they can be removed from SSL profile.

Back to Top

Remove Legacy Ciphers SSL3, DES, 3DES, MD5 and RC4 from cipher group

Complete the following steps to remove SSL3, DES, 3DES, MD5 and RC4:

1. Configuration tab > Traffic Management > SSL > Cipher Groups.

   

2. Select DEFAULT cipher groups > click Add.

   

   Edit the Cipher Group Name to anything else but “Default”

   Check the below list for SSL3, DES, 3DES, MD5 and RC4 ciphers and remove them from the group.

   

3. Click create. You will have a list of ciphers from default cipher group without legacy ciphers.

Back to Top

Remove Legacy Ciphers SSL3, DES, 3DES, MD5 and RC4 from SSL Profile

1. Configuration tab > System > Profiles > SSL Profle Tab > <profile name to be modified> > Edit.

   

2. Select SSL Ciphers > Add > Select Cipher > uncheck SSL3, DES, MD5, RC4 Ciphers > Move the selected ones under configured.

   

3. After moving list of Ciphers to Configured, select OK and save the configuration.

   

   After the above mentioned steps, SSL profile will not have any legacy ciphers.

Back to Top

Disable SSL2.0 and SSL3.0 on NetScaler

Back to Top

Disable SSL 3.0/2.0 on a vserver

The below mentioned command will disable SSL 3.0/SSL2.0 on a vserver
> set ssl vserver vpn -ssl3 DISABLED
> set ssl vserver vpn –ssl2 DISABLED

Back to Top

Disable SSL 3.0/2.0 on SNIP

To disable SSL 3.0/2.0 for a SNIP, internal services on the IP should be identified using following command
>show service –internal | grep <IP> 

Internal services resides inside NetScaler and takes action on behalf of NetScaler. For example an internal service, nshttps-<SNIP IP Address>-443 services SSL connections for the SNIP on NetScaler.

Using the internal service name on the IP, SSL 3.0/2.0 can be disabled using the following command:
set ssl service <internal service name for that ip> -ssl3 disabled
set ssl service <internal service name for that ip> -ssl2 disabled

Back to Top

Disable SSL 3.0/2.0 on NetScaler Management Interface

“nshttps-127.0.0.1-443” is the service running on NetScaler Management Interface.
>show service –internal | grep nshttps-127.0.0.1-443

Using the the following commands, SSL2.0 SSL3.0 can be disabled on older versions of ADC. Replace NSIP in the last command with the NSIP of the device. However if you receive "Warning: Operation not permitted. Use set ssl profile for setting these parameters" then follow the alternate commands:
>set ssl service nshttps-127.0.0.1-443 –ssl2 DISABLED
>set ssl service nshttps-127.0.0.1-443 –ssl3 DISABLED
>set ssl service nshttps-NSIP-443 –ssl3 DISABLED

Alternate commands:
>add ssl profile no_SSL3_TLS1 -ssl3 DISABLED -tls1 DISABLED
>set ssl service nshttps-127.0.0.1-443 -sslprofile no_SSL3_TLS1
>set ssl service nshttps-NSIP-443 -sslProfile no_SSL3_TLS1
 

Back to Top