Mobility Service Vulnerabilities

[candaced]

Just installed my third party certificates onto the Mobility server. My supplier Thawte says my server is vulnerable on two fronts.

It is vulnerable to a BEAST attack and it uses the RC4 cipher algorithm.

I found this Cool Solution https://www.novell.com/communities/coolsolutions/novell-datasync-server-ssl-beast-vulnerability/
BUT it is for Data Synchronizer not Mobility. there is no access to the connector xml from the web admin. So I think I found the connector xml at /etc/datasync/configengine/engines/default/pipelines/pipeline1/connectors/mobility BUT theses tags don't exist

<sslMethod>value</sslMethod>
<sslCiphers>list</sslCiphers>

Do I just add them?

I also found this forum thread,
https://forums.novell.com/showthread.php/406194-Disable-weak-ciphers-and-SSL2-0
but there is no notice of the issue being resolved.

It is also running TLS1.0 and the certificate authority recommends TLS1.2.


I am running Version: 14.2.0 Build: 279

[candaced]

I opened a ticket with support. they said
2014 R2 SP1 Hot Patch 3 does not have the BEAST or RC4 vulnerabilities.
To fix TLS issues I have to upgrade to SLES12

[KonecnyA]

In article <candaced.7whman@no-mx.forums.microfocus.com>, Candaced wrote:
> 2014 R2 SP1 Hot Patch 3 does not have the BEAST or RC4 vulnerabilities.
> To fix TLS issues I have to upgrade to SLES12

might you have apache also running on the system at default settings?
That could be what is being detected.

Also for more such cypher 'fun' https://ideas.microfocus.com/MFI/novell-
gw/Idea/Detail/1533

Thank you for your feed back as that helps us all.


Andy of
http://KonecnyConsulting.ca in Toronto
Knowledge Partner
http://forums.novell.com/member.php/75037-konecnya
If you find a post helpful and are logged in the Web interface, please
show your appreciation by clicking on the star below. Thanks!
GMS troubleshooting tips at http://www.konecnyad.ca/andyk/gwmobility.htm