Can I get some clue on disabling SSLv1, v3 and TLS1.0 on AIX Post: 302973554

Sponsored Content

Operating Systems AIX Can I get some clue on disabling SSLv1, v3 and TLS1.0 on AIX Post 302973554 by agent.kgb on Wednesday 18th of May 2016 05:41:23 PM

05-18-2016

Registered User

it depends...

if you install e.g. OpenSSL libraries on your server and every application on it uses your standard OpenSSL libraries, then it is your responsibility to patch them.

if your application has its own SSL stack, it is application owner's responsibility to patch it.

Example 1. You have AIX LPAR with LDAP-over-SSL connection to LDAP server. For LDAPS connection you must have IBM GSKit installed. GSKit implements SSL/TLS functions. It is a part of system software and you are responsible for patching it.

Example 2. You have AIX LPAR (without LDAPS). WebSphere Application Server runs on this LPAR. To provide SSL to WAS connections you installed GSKit upon request from WAS administrator. It is their (WAS team) responsibility to provide you with a newer version of GSKit to patch potential security problems and test it. It is your responsibility to install it, unless they have root rights.

Example 3. You installed Apache with mod_ssl for your internal documentation server. mod_ssl requires OpenSSL installation. It is your responsibility to update OpenSSL every time a new bug found there.

Example 4. You have an SAP installation. It has its own Java and SSL stack. It is responsibility of SAP administration team to check, test and update their SAP stack, if they have known security problems.

Example 5. You have an AIX LPAR with Tomcat. Tomcat uses Java, which was installed on AIX with default installation, but is administered by Tomcat administrators. You are responsible for updating Java and its SSL libraries on AIX LPAR, but Tomcat administrators are responsible for testing newer Java version with their application.

I have no idea, what you run on your LPARs, which teams are in your organization, how they work together, and so on. It can be rather complicated to decide, who is responsible for what.

This User Gave Thanks to agent.kgb For This Post:

agent.kgb

View Public Profile for agent.kgb

Find all posts by agent.kgb

6 More Discussions You Might Find Interesting

1. Programming

I have no clue what's the point - fcntl() ?

hi, I need to know how to lock a file. I used the following code, but after executing the program the file 'write.txt' remined empty, and I have no idea why.Maybe I'm not using the corresponding syntax for blocking a file. But I deleted then the blocking part and the problem persisted. see to...

2. Solaris

Filesystem filling up and no clue as to why!

df shows that the filesystem is filling up and the usage is 94%. However when I actually traverse to the directory I du shows only about 10% of the space occupied! Below is the output of df and du: >>>df -kh /cbmdata/00 470M 393M 29M 94% /cbmdata/00 >>>/cbmdata/00>...

3. AIX

Disabling an ASCI terminal in AIX versions 3 and 4

Hi, I tried to do some research on this subject, but got nothing conclusive. I have the following need: I have different servers with AIX versions 3.2.5 through 4.3.2. Some of them have two ASCI terminals connected. I have a shell script that is executed by a user on the main console...

4. AIX

Disabling SSH direct access for an AIX user

Hello everyone, Can anyone help me please. I want to disable SSH direct access for an AIX user. For example, if I have USER1 and USER2. I want to disactivate direct access for USER2. The user must enter his login (USER1) and his password and then he can do su - USER2 . Thanks,

5. AIX

Disabling SNMP in AIX 7.1

Hi, I am planning to disable SNMP in our AIX LPARs. wanted to see by disabling in a test LPAR. before that, I would like to check disabling this SNMP will impact any of our application or database in anyway. what kind of other software depends on these SNMP daemons ? Can you please let me...

6. AIX

Disabling entries on inetd.conf (AIX).

Hello, We're working on securing the AIX environment. started with disabling unused services on AIX. Below are the entries which are not commented on my test LPAR (even other LPARs). ntalk dgram udp wait root /usr/sbin/talkd talkd daytime stream tcp nowait root...

LEARN ABOUT SUSE

net::ldaps

Net::LDAPS(3)						User Contributed Perl Documentation					     Net::LDAPS(3)

NAME

       Net::LDAPS - use LDAP over an SSL connection

SYNOPSIS

	use Net::LDAPS;

	$ldaps = Net::LDAPS->new('myhost.example.com',
				 port => '10000',
				 verify => 'require',
				 capath => '/usr/local/cacerts/');

	# alternate way
	use Net::LDAP;

	$ldaps = Net::LDAP->new('ldaps://myhost.example.com:10000',
				verify => 'require',
				capath => '/usr/local/cacerts/');

DESCRIPTION

       Communicate using the LDAP protocol to a directory server using an encrypted (SSL) network connection. This mechanism is non-standard but
       widely supported; consider using LDAPv3 with the standard TLS extension if possible (many servers do not support it yet.) See "start_tls"
       in Net::LDAP.

       All the normal "Net::LDAP" methods can be used with a "Net::LDAPS" object; see Net::LDAP for details.

CONSTRUCTOR

       new ( HOST [, OPTIONS ] )
	   Create a new connection. HOST is the hostname to contact. OPTIONS is a number of key/value pairs. See "new" in Net::LDAP for details.

SEE ALSO

       Net::LDAP, IO::Socket::SSL

BUGS

       You cannot have more than one LDAPS connection at any one time, due to restrictions in the underlying Net::SSLeay code.

AUTHOR

       Chris Ridd <chris.ridd@isode.com>

COPYRIGHT

       Copyright (c) 2000-2004, Chris Ridd and Graham Barr. All rights reserved. This library is free software; you can redistribute it and/or
       modify it under the same terms as Perl itself.

perl v5.12.1							    2010-03-12							     Net::LDAPS(3)