Mitigating the SSLv3 POODLE attack in Application HA 6.1 console and guests

Problem

Running a security vulnerability scan on networks that have Application HA guests can result in SSLv3 POODLE attack flags on the xptrld process that is part of the Application HA console and guests.
 

Cause

The xptrld process has the SSLv3 transport method enabled and will be flagged on security scans.
 

Solution

Disabling SSLv3 on the Application HA console:

1. Open the server.xml located at %vcs_root%\ApplicationHA\tomcat\conf.
2. Add the following line after the sslProtocol=”TLS” section:

sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"



Example config section:
<Connector port="${ssl.port}" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" allowUnsafeLegacyRenegotiation="false" keystoreFile="${tomcat.home}/cert/.keystore" compression="on" compressableMimeType="text/html,text/xml,text/plain,text/css,text/javascript" URIEncoding="UTF-8" keystorePass="cortech"/>​  

1. Restart the Application HA service.
2. To verify that SSLv3 has been disabled from a Windows machine, install the OpenSSL binaries and run the following command:  

openssl s_client -connect <console_machine_ip>:14152 -ssl3


Disabling SSLv3 on Application HA guests:

1. Upgrade the VRTSsfmh installation to version 7.1. This can be found on SORT (https://sort.veritas.com/) after you’ve logged into your Veritas account. It can also be downloaded from the following public location: https://www.veritas.com/content/trial/en/us/veritas-infoscale-operations-manager. Be sure to run the installer as an administrator on a Windows machine.
2. To verify that SSLv3 has been disabled from a Windows machine, install the OpenSSL binaries and run the following command:

openssl s_client -connect <guest_machine_ip>:5634 -ssl3
 


Disabling weak ciphers:

1. Navigate to C:\ProgramData\veritas\VRTSsfmh\sec\systemprofile\ and open VRTSatlocal.conf.
2. Find the following:  SSLCipherSuite"="HIGH:MEDIUM:!eNULL:!aNULL:!SSLv2 and replace it with SSLCipherSuite"="HIGH:MEDIUM:!RC4:!eNULL:!aNULL:!SSLv2
3. Restart the Veritas Storage Foundation Messaging service. ie. xprtld service.