Description

Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network. Several versions of the protocol find widespread use in applications such as web browsing, email, instant messaging, and voice over IP (VoIP). Websites can use TLS to secure all communications between their servers and web browsers.

Sometimes, however, a security scanner might flag TLS 1.0 as a vulnerability threat and removing/disabling it may be needed. This article explains how to disable TLS 1.0 on EX2300 Series switches when encountered with such an event.

 

Solution

To disable TLS 1.0 on EX2300 Series switches, perform the following steps:

  1. Log in to the switch and verify that the httpd process is running. Issue the show system processes extensive | match http command as follows: 
{master:0}
root@ex2300-c-2> show system processes extensive | match http
18456 nobody    20    0 14844K  7892K select   0:00   0.00% httpd
18416 root      20    0   280M 10088K select   0:00   0.00% httpd-gk

  1. Go to shell, and then go to the /jail/var/etc/ directory. 

root@ex2300-c-2> start shell
root@ex2300-c-2:RE:0% cd /jail/var/etc/

  1. Under the /jail/var/etc/ directory, look for httpd.conf . 

root@ex2300-c-2:RE:0% ls -ltr
total 224
-rw-r--r--  1 root  wheel      0 Dec 31  1969 hosts
-rw-r--r--  1 root  wheel      0 Dec 31  1969 issue
-rw-------  1 root  wheel      0 Dec 31  1969 pam_radius.conf
-rw-------  1 root  wheel      0 Dec 31  1969 pam_tacplus.conf
-rw-------  1 root  wheel  40960 Dec 31  1969 spwd.db
-rw-r--r--  1 root  wheel  40960 Dec 31  1969 pwd.db
-rw-r--r--  1 root  wheel    559 Dec 31  1969 passwd
-rw-r--r--  1 root  wheel     94 Dec 31  1969 resolv.conf
-rw-r-----  1 root  wheel    918 Dec 31  1969 pam.conf
-rw-------  1 root  wheel    741 Dec 31  1969 master.passwd
-rw-r--r--  1 root  wheel   3600 Dec 31  1969 login.conf
-rw-r--r--  1 root  wheel    286 Dec 31  1969 group
-rwxr-xr-x  1 root  wheel   2819 Dec 31  1969 localtime
-rw-r--r--  1 root  wheel   1788 Dec 31  1969 httpd.conf
-rw-r--r--  1 root  wheel      0 Dec 18 03:35 hosts.allow

  1. Edit the file by using the vi httpd.conf command.

  2. Insert the following line in the httpd.conf file and save it. To save the file, type " :wq ". 

root@ex2300-c-2:RE:0% vi httpd.conf
ErrorLog /var/log/httpd.log
LogLevel 2
DirectoryIndex index.php
ThreadLimit 10
LimitClients 400
LimitRequestBody 1400000000
LimitUploadSize 1400000000
LimitRequestFields 512
LimitRequestFieldSize 1048576
LimitResponseBody 10000000
LimitStageBuffer 8192
LimitChunkSize 8192
LimitUrl 30000
IdleTimeout 3600
Timeout 1500
SSLProtocol all -TLSV1
User nobody
Group nobody
TypesConfig /jail/etc//mime.types
Expires 5184000 text/html application/x-javascript image/png image/svg image/svg
+xml image/jpeg text/css application/x-shockwave-flash image/gif
TimeZone America/Los_Angeles
KeepAlive on
:wq

  1. Review the content of the file and make sure that the line that you inserted is there. 

root@ex2300-c-2:RE:0% cat httpd.conf | grep SSL
SSLProtocol all -TLSV1

  1. Run the show system processes extensive | match http command to see the PID for the httpd process. 

{master:0}
root@ex2300-c-2> show system processes extensive | match http
18456 nobody    20    0 14844K  7892K select   0:00   0.00% httpd
18416 root      20    0   280M 10088K select   0:00   0.00% httpd-gk

  1. Restart the httpd process by issuing the request system process terminate <PID> command as follows: 

{master:0}
root@ex2300-c-2> request system process terminate 18456

  1. Check the httpd process again to make sure that it has been restarted. A new PID will be generated, which is different than the one that we terminated in the previous step. 

{master:0}
root@ex2300-c-2> show system processes extensive | match http    
18416 root      20    0   280M 10100K select   0:00   0.00% httpd-gk
66721 root      33    0 14844K  7904K RUN      0:00   0.00% httpd