Weak SSL Cipher

[Former Member]

Hi Security Experts,

While running vulnerability scans before deploying new Application servers NW 7.31 ABAP, kernel 401 for windows.  we are getting weak ssl cipher supported error with port

5$$14 SAP MMC listener https port. We have SSL configured with default parameters. \

Can you suggest steps to increase the SSL strength of this port. Worst case, can you suggest steps to disable this port.

the OS is windows 2008 R2 x64,

regards

Yogesh

[Former Member]

I'm not sure how you could set the ciphersuite for sapstartsrv. You can disable the HTTPS port by following instructions given in SAP note 1036107.

[Former Member]

Since the SAP instance specific sapstartsrv is using the instance profile you could try to set ssl/ciphersuites according to SAP note 510007 and see if it helps.

[Former Member]

Thank you, I will add the parameter and see if that fixes this problem.

looking at the details of the parameter, my worry is if this will break something which is working. I believe this parameter change will apply to all communication http/https which is happening over other SAP ports as well. I would do some tests but is there something you suggest I look at.

[Former Member]

Yes that parameter will affect ICM services as well. Apart from testing the impact, I have no other recommendations.

[Former Member]

Yogesh-

Follow this SAP note:

510007 - Setting up SSL on Web Application Server ABAP

and set appropriate values for ssl/ciphersuites and  ssl/client_ciphersuites. While setting these params make sure you check all your certificate based connections and make sure that they support the similar level encryption. Thanks

[Former Member]

Thank you for this information. After analyzing the parameters, I am worried it will generate a whole lot of work. Adding cipher control on the SSL communication. We have over 20+ production SAP and non-sap system communication with each other via http/https. I don't want to add additional complication to the already complex setup.

Samuli earlier explained that SAP note 1036107 has steps to disable https communication, I could not find steps to disable the communication, I do see steps on how to enable https for SAP MC. But I checked my system, most of the settings described are not there still I see in most of our systems 5$$14 is there.

Would you be so kind to provide steps on how to disable this service.

regards

Yogesh

[Former Member]

Login to the HTTP port (5xx13) of your SAP MC using a browser. A Java applet is launched and that is why you need to have a working Java runtime. In the Java applet select menu entry Tools -> Settings... and uncheck "Use HTTPS".

[Former Member]

Correct, you can even delete the indicator from tools--> settings.

Also, refer to 1439348 - Extended security settings for sapstartsrv :

"Restrict network access

Another option is to restrict the remote access via the network to ports 5XX13 / 5XX14 of the sapstartsrv agents to a minimum level required for operation. For example, restrict it so that only the sapstartsrv of a system can communicate with each other, and the Webservice clients used (SAP MMC, SAP MC, ...) from the computers from which they are operated (for example, Administrator Desktop PC). In addition to pure network routing measures, current sapstartsrv (as of 720 patch 45) offer the option to specify network ACL lists using the profile parameters service/http/acl_file and service/https/acl_file. After you set the profile parameters or change the ACL lists, you must restart the affected sapstartsrv to activate the changes. Note 1495075 describes the syntax of the ACL files."

[Former Member]

That checkbox is already disabled when I connect via http. I connect via https and disable it but the access point is still there. I stopped and restarted the SAP service but same result.

I guess what you are suggesting is to switch the SAP MC connection to https/http but it is not disabling the SAP service listening on 5$$14. My problem is that this access point is available, we have a scan going on via a 3rd party which is scanning this port and finding that it allows weak ciphers.

How can I disable this access point altogether is still a question. From what I could find so far is that once I enable SSL, it automatically enables the 50014 https service. Not sure how to disable it. I will try and reverse engineer the note SAP note 1036107 suggested by Samuli if that works but in case you have other ideas.

Yogesh

[martin_voros]

Hi Yogesh,

your original issue was that SSL was allowing some weak cipher suits to be used for connection. For example you really do not want to use suites that use 3DES. This is a common issue and you just need to disable these weak suites. The only issue you could get from disabling these weak suites is if you have a really really old client that does not support new crypto primitives such as block cipher AES and hash function SHA-1. What happens during initialization of connection is that client and server agree on cipher suite that will be used to protect connection. You just want to configure server that it won't allow some suites to be used. Hence you could have a situation when old client supports only weak cipher suites and server does not want to use any of these. Hence the connection fails because they can't agree on cipher suite.

Honestly, disabling HTTPS access to MC sounds like a really terrible idea. Basically, your auditors are saying that they do not like you accessing this sensitive service over weak cipher suites. Your answer is that let's not use any encryption at all. Hence you are trying to resolve one minor issue by introducing much bigger issue. Do you really think that auditors will be happy with your solution? Regardless what auditors think you should really want to protect it and you should not access it over HTTP. 

Cheers

[Former Member]

Hi Martin,

Thank you.

One thing I don't understand, why only this port is giving this weak cipher issue. We have ssl enabled which means it will be effective for all ports. We have standard 443 https ports but this issue does not show up there. Anyway right now we have both http and https access to SAP MC, I am trying to disable https for this port, so nothing worse than what we currently have,  which seemingly does not seem possible. I even got confirmation from SAP that if you select SSL, this port gets active by default and there is no way of disabling it.

Of-course I am not putting off fixing this, but currently cannot put in the efforts of changing something which may have a widespread impact. We will plan in a big list of changes based on its priority.

I will close the thread, thank you all for your inputs.

Yogesh

[Former Member]

Then sapstartsrv is not behaving the same way as ICM is, sounds like a bug to me. I guess sapstartsrv is not even respecting the ssl/ciphersuites parameter.

[martin_voros]

Hi,

I still believe that leaving it as is is a better option than disabling HTTPs connection. I know that it will "resolve" one of your issues but it's not right. It's just dump following of recommendation from audit.

As Samuli mentioned I would raise a ticket with SAP. I would ask how you can control SSL cipher suites used by sapstartsrv. Before raising a ticket I would double check what cipher suites are offered by standard HTTPS port used for serving various web based services and port 5xx14. Is it possible that your 443 port is actually open on web dispatcher or other reverse proxy and hence it gets config from somewhere else?

Cheers