IBM License Metric Tool (ILMT)

IBM License Metric Tool (ILMT)

Connect with Db2, Informix, Netezza, open source, and other data experts to gain value from your data, share insights, and solve problems.

 View Only
Back to discussions
Expand all | Collapse all

How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

  • 1.  How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Mon September 25, 2023 08:38 AM

    Hi there,

    I am trying to find documentation relative to TLS configuration in LMT (9.2.33.0 with BigFix) on Windows.

    As security scanning listed TLS 1.0/1.1 as deprecated we consider disabling those options.

    TLS Version 1.0 and 1.1 Protocol Deprecated

    52311 / tcp / www         ilmtsrv2

    52315 / tcp / www         ilmtsrv2

    8083 / tcp / www            ilmtsrv2

    I found this in the jvm.options file:

    -Dcom.ibm.jsse2.overrideDefaultTLS=true
    -Dcom.unboundid.util.SSLUtil.defaultSSLProtocol=TLSV1.2
    -Dcom.unboundid.util.SSLUtil.enabledSSLProtocols=TLSV1.2

    So, is this something I have to set/modify in ILMT config files (to exclude TLS 1.0/1.1) or BigFix (or both)?

    Thanks for pointing me to the correct official documentation.

    Cheers, Igor



    ------------------------------
    Igor P. Merkù
    ------------------------------



  • 2.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Mon September 25, 2023 10:05 AM

    Hello Igor,

    Actually there is no need to modify anything in ILMT config files at all.
    ILMT server from around 9.2.26 always uses TLSv1.2.
    By default, TLS 1.0/1.1 connections (inbound & outbound) would be rejected by ILMT server.

    From those above TCP ports ILMT is using only one: 52311
    and that connection is always done by means of TLSv1.2.

    You can remove those three properties from jvm.options file altogether.
    Those are obsolete properties not used anymore...



    ------------------------------
    Thank you,
    Oktawian

    Oktawian Powązka, L3 Support
    IBM License Metric Tool
    ------------------------------

    Original Message


  • 3.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Tue September 26, 2023 04:12 AM

    Hello Oktawian,

    thanks a lot for your reply. I have commented those three lines and restarted, seems to work everything normally.

    From the little I understand in Windows server I found this:

      TCP    0.0.0.0:8080           0.0.0.0:0              LISTENING       1636
      TCP    0.0.0.0:8083           0.0.0.0:0              LISTENING       1636
      TCP    0.0.0.0:52311          0.0.0.0:0              LISTENING       1572
      TCP    0.0.0.0:52315          0.0.0.0:0              LISTENING       1572

    BESRootServer.exe             1572 Services                   0     36.552 K
    BESWebReportsServer.exe       1636 Services                   0     97.084 K

    Looks like it is not ILMT listening to those ports, but BigFix, am I correct? I would assume that the vulnerability scanner just does not know better and associates those ports all to ILMT and not making any distinction between BigFix and ILMT.

    My lack of understanding is whether we need BigFix listening to 8083 and 52315 ports ... I guess there is some document describing the overall structure of BigFix/ILMT and services/ports, right? Will search for that to better understand.

    After an additional vulnerability scan I still receive the suggestion to disable TLS 1.0 and 1.1.

    Where can you direct me to look for this?

    Thanks a lot, Igor



    ------------------------------
    Igor P. Merkù
    ------------------------------

    Original Message


  • 4.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Tue September 26, 2023 05:00 AM

    Hello Igor,

    Following is the document describing BigFix/ILMT services/ports :
    https://www.ibm.com/docs/en/license-metric-tool?topic=ir-network-port-requirements

    Your assumption is correct, those are BigFix ports.
    8080/8083 : WebReports  (required by ILMT infrastructure),
    52311        : BigFix Server (required by ILMT infrastructure),
    52315       : BigFix WebUI (not required by ILMT infrastructure)

    If that BigFix environment is only used for ILMT I'd suggest to remove BigFix WebUI component.
    That way you will exclude at least one component from equation...


    I don't think that port 8080 (Used by WebReports) is an issue here as it's solely used for HTTP communication.
    Thus, no TLS handshake can be established on that port...
     

    You could enable Enhanced Security to force TLS 1.2 only (disable TLSv1.0 and TLSv1.1) :
    https://help.hcltechsw.com/bigfix/10.0/platform/Platform/Installation/c_security_settings.html



    ------------------------------
    Thank you,
    Oktawian

    Oktawian Powązka, L3 Support
    IBM License Metric Tool
    ------------------------------

    Original Message


  • 5.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Tue September 26, 2023 05:43 AM
    Edited by Igor P. Merkù Tue September 26, 2023 05:47 AM

    Hello Oktawian,

    thanks for your help.

    I have activated the Enhanced Security and security scan remains with 8083 TLS 1.0 and 1.1 active, others are not detected any more. 

    So, as you said, as ILMT needs 8083 and that is internal comunication (BigFix and ILMT on same server), that should not be an issue or can I force TSL 1.2 on that port somehow (or shouldn't I)?

    Thanks a lot for your help, very much apprechiated.

    Kind regards, Igor



    ------------------------------
    Igor P. Merkù
    ------------------------------

    Original Message


  • 6.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Wed September 27, 2023 02:54 AM

    Hi Igor,

    have you8 checked Computer Setting _WebReports_HTTPServer_RequireTLS12.via BigFix Console, s documentation

    https://help.hcltechsw.com/bigfix/9.2/platform/Platform/Web_Reports/c_web_reports_https_registry_set.html

    regards Michael



    ------------------------------
    Michael Koester
    IBM License Management Consultant
    ARS Computer und Consulting GmbH
    Munich, Germany
    +49 89 32468 0
    ------------------------------

    Original Message


  • 7.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Wed September 27, 2023 09:07 AM
    Edited by Igor P. Merkù Wed September 27, 2023 09:07 AM

    Hallo Michael,

    "Endpoint Manager Console" - not familiar with, don't recall using it, ever.

    As a recap: we have BigFix for ILMT exclusively, no other BigFix functionality licensed (nor implemented, of course).

    So, maybe this configuration step is beyond the scope of my question. I guess, I will leave it with what is now configured.

    Besten Dank, thanks a lot, Igor



    ------------------------------
    Igor P. Merkù
    ------------------------------

    Original Message


  • 8.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Wed September 27, 2023 02:22 PM

    'Endpoint Manager console' is 'BigFix Console'...
    basically 'Endpoint Manager' means BigFix  



    ------------------------------
    Thank you,
    Oktawian

    Oktawian Powązka, L3 Support
    IBM License Metric Tool
    ------------------------------

    Original Message


  • 9.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Thu September 28, 2023 03:24 AM

    Oh, I see, thanks a lot Oktawian.

    As for the document mentioned by Michael, the only thing that differs between doc and what you, Oktawian, wrote previously is the port used by

    _WebReports_HTTPServer_PortNumber

    where doc says 443 and you wrote 8083. Do I leave it with 8083?

    In my configuration I have 8083. All other mentioned parameters are set as doc.

    Thanks, Igor



    ------------------------------
    Igor P. Merkù
    ------------------------------

    Original Message


  • 10.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Thu September 28, 2023 05:13 AM

    Indeed...
    I think that BigFix team has changed this default '_WebReports_HTTPServer_PortNumber' somewhere during the process...
    So, depending on WebReports version you will encounter one of those two.  



    ------------------------------
    Thank you,
    Oktawian

    Oktawian Powązka, L3 Support
    IBM License Metric Tool
    ------------------------------

    Original Message


  • 11.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Tue October 03, 2023 05:57 AM

    Hello Oktawian,

    I have to come back to this question now that I have gathered more insight.

    Browsing through the HCL/BigFix documentation I came onto this page

    https://help.hcltechsw.com/bigfix/9.2/platform/Platform/Config/c_restapi_https_registry_set.html

    In my BigFix environment, when opening "Edit Settings for Computer" ILMTSRV2, which is in my case server for both ILMT and BigFix, I cannot find any setup for

    _BESRelay_HTTPServer_SSLPrivateKeyFilePath
    _BESRelay_HTTPServer_SSLCertificateFilePath 

    When I go into Add, there is no such option in the drop down list.

    What is my installation missing?

    Thanks, Igor



    ------------------------------
    Igor P. Merkù
    ------------------------------

    Original Message


  • 12.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Tue October 03, 2023 07:58 AM

    Hi Igor,

    To be honest not sure which drop down list do you have on mind...
    After you click 'Add' you have to add a new Custom Setting (name/value).



    ------------------------------
    Thank you,
    Oktawian

    Oktawian Powązka, L3 Support
    IBM License Metric Tool
    ------------------------------

    Original Message


  • 13.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Tue October 03, 2023 08:27 AM
    Edited by Igor P. Merkù Tue October 03, 2023 08:29 AM
      |   view attached

    After clicking on "Add Custom Settings" a Dialog comes up. There is a drop down list ... but can't find the items

    _BESRelay_HTTPServer_SSLPrivateKeyFilePath
    _BESRelay_HTTPServer_SSLCertificateFilePath 

    Do you mean I can write those parameter names into the dialog myself? Is that what doc means with "do not create a second one" and "if it does not exist, add it"? So, can I add a parameter that is not listed in the drop down?

    4. Look for _BESRelay_HTTPServer_SSLPrivateKeyFilePath setting. If it exists, do not create a second one, but edit its value to the full path name of the private key (.pvk file which contains the private key for the server. The private key must not have a password. If it does not exist, add it.

    I am afraid to touch anything to break the system (although I could put the VM into snapshot...) 

    Thanks, Igor



    ------------------------------
    Igor P. Merkù
    ------------------------------

    Original Message


  • 14.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Tue October 03, 2023 09:30 AM

    Ok...got it.
    Funny thing as I've never clicked this Dropdown icon.
    For me it look insane...why would you want to re-add the same Setting ?
    Actually, when you try to pick up one of the existing ones and change its value it bounce back with 'already exist' message...which make sense.

    Anyhow, you can of course write those new parameters into the dialog.
    Just add a parameter that is not listed in the drop down...



    ------------------------------
    Thank you,
    Oktawian

    Oktawian Powązka, L3 Support
    IBM License Metric Tool
    ------------------------------

    Original Message


  • 15.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Wed October 04, 2023 04:13 AM
    Edited by Igor P. Merkù Wed October 04, 2023 04:28 AM
      |   view attached

    Hello Oktawian,

    so I was looking into this: "

    52315       : BigFix WebUI (not required by ILMT infrastructure)"

    and found

    https://help.hcltechsw.com/bigfix/9.5/webui/WebUI/Admin_Guide/c_remove_the_web_service.html

    But the only fixlet with WebUI comes up is to install it, so I don't even have it but the port is open? 

    Deploy this Fixlet on a device to install the BigFix WebUI Service

    The vulnerability scanner, after all the work and backup-and-forth with the certificates, adding parameters etc as further down discussed, did not help or change anything. Still, on port 52315 a non trustable certificate (which is a standard, selfsigned cert) is detected.

    52315 / tcp / www
    ilmtsrv2

    And I don't find any settings in the Computer Settings for the ilmt server with that 52315 port ...

    Where do I go from here, close the port on windows firewall? I have checked in windows firewall that there WebUI is not listed in allowed apps (well, it is not installed, so that is ok). I could add a rule to block traffic on that port. Although I don't understand how there is anything on that port anyway ...

    Thanks, Igor



    ------------------------------
    Igor P. Merkù
    ------------------------------

    Original Message


  • 16.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Wed October 04, 2023 06:28 AM

    Hi Igor,

    Small clarification to my previous update.

    Port 52315 is always opened from BES Root Server itself, regardless if WebUI is installed or not.
    Nevertheless, that port is only used for the communication between BigFix Server and WebUI.
    And yes, it presents a self-signed cert (signed by 'WebUI Certificate Authority', so, definitely not trusted).


    As you don't seems to have WebUI installed the simplest solution would be to block that port on firewall.

    To be honest I'm not sure of there is a documented procedure to replace this particular self-signed cert.
    Following is a guideline how to     setup certificate for BigFix WebUI itself:
    https://help.hcltechsw.com/bigfix/9.5/webui/WebUI/Admin_Guide/c_ssl_cert_configuration.html
    But, as I understand this procedure can only be applied if WebUI is installed.

    I guess that it's HCL which can resolve this conundrum...



    ------------------------------
    Thank you,
    Oktawian

    Oktawian Powązka, L3 Support
    IBM License Metric Tool
    ------------------------------

    Original Message


  • 17.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Wed October 04, 2023 09:59 AM

    Hello Oktawian,

    thank you very much for your patience and valuable input, I very mcuh aprechiate it.

    In the meantime ...

    Why is BigFix identified as "Use of an untrusted SSL certificate" when being scanned by a 3rd-party scan tool? (hcltechsw.com)

    saying that indeed 52311 (in standard config) will present a self signed certificate etc. In standard config that applies to 52315 also, as the process BESRootServer listenes to both ports, regardless of WebUI (52315) installation or not, as you said.

    Indeed, I have blocked the port 52315 on the server's windows firewall.

    I also found that I forgot to set to "1" the value for _WebReports_HTTPServer_RequireTLS12 which also has been detected by the vulnerability scanner. So fixed this one, too.

    Thanks a lot.

    Kind regards, Igor



    ------------------------------
    Igor P. Merkù
    ------------------------------

    Original Message


  • 18.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Wed October 04, 2023 05:53 AM
      |   view attached

    Also BESRemove says WebUI Service is not installed.



    ------------------------------
    Igor P. Merkù
    ------------------------------

    Original Message


  • 19.  RE: How to disable TSL 1.0/1.1 - or force TLS 1.2 use - implications?

    Posted Fri October 06, 2023 10:24 AM

    Stronger Encryption: TLS 1.2 offers more secure encryption algorithms compared to TLS 1.0 and 1.1. Disabling the older versions ensures that only the most secure encryption is used, enhancing the protection of sensitive data.



    ------------------------------
    apk vest
    ------------------------------

    Original Message


Related Content