Sponsored Content
Operating Systems AIX Can I get some clue on disabling SSLv1, v3 and TLS1.0 on AIX Post 302973426 by bakunin on Tuesday 17th of May 2016 04:16:37 PM
Old 05-17-2016
Quote:
Originally Posted by system.engineer
Application/Middleware engineer supposed to work on this task (disabling these protocols)
Exactly. SSL is, basically, implemented as a (shared) library. Applications use from that library whatever they want to use. If they want to use insecure protocols they do it and if they are programmed correctly the don't do it. But from the POV of the library it is simply not its decision.

You can, of course, use some firewall software with stateful inspection and acting as a "transient SSL proxy", in which you could create rules to effectively forbid certain crypto-protocols.

This would be similar (and have similar consequences) to removing, say, "telnet" (the binary) from your system. If there would be a script using this "telnet" it would simply stop working. The applications using the protocols you forbid as outlined above would not be able to make any connection any more (and perhaps stop working, at least in this regard), but they wouldn't start working differently - for the same reason the script would not start to use "ssh" once "telnet" is not available any more.

One more word about these requests, because i got the same nonsense requested three times now: it is typically the request of someone not knowledgeable enough to be in either systems administration or programming, which is whe s/he ended up as "security advisor" and trying hard to make sure everybody else is getting done as little as the advisor himself.

These are the guys who want you to have 27-digits long passwords, containing no known words and at least 8 characters you can't enter from the keyboard, changing them every three days but do not write them down! I bet that in every office with such policies i can find at least one post-it note with the PW under some keyboard. And the number of post-its i will find will increase with the length and overall absurdity of these rules, so they won't increase but in fact decrease security.

I hope this helps.

bakunin
This User Gave Thanks to bakunin For This Post:
 

6 More Discussions You Might Find Interesting

1. Programming

I have no clue what's the point - fcntl() ?

hi, I need to know how to lock a file. I used the following code, but after executing the program the file 'write.txt' remined empty, and I have no idea why.Maybe I'm not using the corresponding syntax for blocking a file. But I deleted then the blocking part and the problem persisted. see to... (2 Replies)
Discussion started by: atticus
2 Replies

2. Solaris

Filesystem filling up and no clue as to why!

df shows that the filesystem is filling up and the usage is 94%. However when I actually traverse to the directory I du shows only about 10% of the space occupied! Below is the output of df and du: >>>df -kh /cbmdata/00 470M 393M 29M 94% /cbmdata/00 >>>/cbmdata/00>... (3 Replies)
Discussion started by: zombiezparadize
3 Replies

3. AIX

Disabling an ASCI terminal in AIX versions 3 and 4

Hi, I tried to do some research on this subject, but got nothing conclusive. I have the following need: I have different servers with AIX versions 3.2.5 through 4.3.2. Some of them have two ASCI terminals connected. I have a shell script that is executed by a user on the main console... (2 Replies)
Discussion started by: andrei_r20
2 Replies

4. AIX

Disabling SSH direct access for an AIX user

Hello everyone, Can anyone help me please. I want to disable SSH direct access for an AIX user. For example, if I have USER1 and USER2. I want to disactivate direct access for USER2. The user must enter his login (USER1) and his password and then he can do su - USER2 . Thanks, (3 Replies)
Discussion started by: adilyos
3 Replies

5. AIX

Disabling SNMP in AIX 7.1

Hi, I am planning to disable SNMP in our AIX LPARs. wanted to see by disabling in a test LPAR. before that, I would like to check disabling this SNMP will impact any of our application or database in anyway. what kind of other software depends on these SNMP daemons ? Can you please let me... (9 Replies)
Discussion started by: system.engineer
9 Replies

6. AIX

Disabling entries on inetd.conf (AIX).

Hello, We're working on securing the AIX environment. started with disabling unused services on AIX. Below are the entries which are not commented on my test LPAR (even other LPARs). ntalk dgram udp wait root /usr/sbin/talkd talkd daytime stream tcp nowait root... (1 Reply)
Discussion started by: system.engineer
1 Replies
XRLOGIN(1)						      General Commands Manual							XRLOGIN(1)

NAME
xrlogin - start an xterm that uses ssh (or optionally rlogin or telnet) to connect to a remote host SYNOPSIS
xrlogin [-l username] [-rlogin|-telnet] [xterm options] remote-host DESCRIPTION
Xrlogin opens an xterm window and runs ssh, rlogin or telnet to login to a remote host. Xrlogin automatically passes the -name argument to xterm with a value of "xterm-hostname" where hostname is the name of the remote host. This allows the user to specify resources in their server's resource manager which are specific to xterms from a given host. For example, this feature can be used to make all xterm windows to a given remote host be the same color or use a specific font or start up in a spe- cific place on the screen. Xrsh(1) passes the same string so they are compatible in this regard. Xrlogin specifies that the default title for the new xterm will be "hostname" where hostname is the name of the remote host. This and the -name argument above can be overridden with xterm-options on the command line. One could also use xrlogin's sister command xrsh(1) to open a window to a remote host. In the case of xrsh, the xterm would run on the remote host and use X as the connection protocol while xrlogin would run the xterm on the local host and use rlogin or telnet as the con- nection protocol. See xrsh(1) for a discussion of the merits of each scheme. OPTIONS
-l username When not using -telnet, use username as the id to login to the remote host. -rlogin Use the rlogin protocol to open the connection. In general rlogin is preferred because it can be configured to not prompt the user for a password. Rlogin also automatically propagates window size change signals (SIGWINCH) to the remote host so that applications running there will learn of a new window size. -telnet Use the -telnet protocol to open the connection. Use of telnet provided mostly for hosts that don't support rlogin. COMMON PROBLEMS
Make sure that the local host is specified in the .rhosts file on the remote host or in the remote hosts /etc/hosts.equiv file. See rlogin(1) for more information. EXAMPLES
xrlogin -bg red yoda Start a local red xterm which connects to the remote host yoda using rlogin. xrlogin -telnet c70 Open a local xterm which connects to the remote host c70 using telnet. SEE ALSO
xrsh(1), rlogin(1), telnet(1) AUTHOR
James J. Dempsey <jjd@jjd.com> and Stephen Gildea <gildea@intouchsys.com>. X Version 11 Release 6 XRLOGIN(1)
All times are GMT -4. The time now is 12:38 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy