HAA Machine SSL Cipher Suites Vulnerability

News Knowledge Base
1

How to Remove SSL Medium Strength Cipher Suites Supported (SWEET32) From HAA machines

Issue:

SSL Medium Strength Cipher Suites Supported (SWEET32) on HAA Machines

Error Code:

Security scan reports SSL Medium Strength Cipher Suites Supported (SWEET32)

Root Cause:

The presence of 3DES (Triple DES) cipher suites on the HAA machines is triggering the vulnerability alert. These cipher suites are considered weak and susceptible to the SWEET32 attack.

Resolution:

To remediate this issue, disable the DES cipher suites by configuring the cluster to exclude 3DES. Follow the steps below:

  • SSH into any one of the Redis / HAA nodes.
  • Run the following command: rladmin cluster config control cipher_suites 'DEFAULT:!3DES'
  • This command will disable DES cipher suites on the relevant ports (8443, 9443, and 3344).
  • After executing the command, re-run the security scan to confirm that the vulnerability has been resolved.

Note:

Ensure you have appropriate access and take necessary backups or consult with your security team before making configuration changes.