Skip to content
ATO Pathways
  Log In

The Infoblox system must present only approved TLS and SSL cipher suites.

An XCCDF Rule

Description

<VulnDiscussion>Infoblox systems ship with a wide range of cipher suites to support management in a variety of customer environments. Infoblox may have customers that require these cipher suites for backward compatibility. Over time specific cipher suites may become unfavorable for a variety of reasons, including being replaced by stronger suites, or vulnerabilities are discovered and they are no longer considered secure. Configuration of cipher suites within NIOS directly affects the default HTTPS management system. Note that Infoblox systems do not enable Secure Shell (SSH) by default, but it can be enabled by system administrators and shares configuration of the cipher suites with HTTPS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID
SV-233888r621666_rule
Severity
Medium
References
Updated



Remediation - Manual Procedure

1. Close all existing HTTPS management sessions and log on to the Grid Master, or the stand-alone system using the CLI. 
2. Use the following command to display the status: "show ssl_tls_settings".
3. If the output shows "default", the system administrator must first override the default settings to enable editing using the following command: "set ssl_tls_settings override".
4. For each cipher suite to be disabled, use the following procedure. Identify the numerical designation of the cipher suite using: "show ssl_tls_ciphers".
5. Use the following command to disable, replacing NNN with the appropriate number: "set ssl_tls_ciphers disable NNN".
6. Repeat this procedure to disable unapproved cipher suites. The numerical list will be reordered each time it is modified and requires careful validation.