How do I remove legacy ciphers on NetScaler?
Use case
Ramesh wishes to interact in a secure fashion (some arbitrary, some known) free from any
security attack through a web browser. Recent attacks on weaker ciphers in SSL layer has
rendered them useless and thus Ramesh wants to ensure that he is not using the weak ciphers.
Banking.com wishes to host webservers to be used by people like Ramesh in a secure fashion
free from any security threat.
Secure transfer of data between the client and server is facilitated by Transport Layer Security(TLS) and
its predecessor Secure Socket Layer(SSL). They are not just used by websites that use HTTP protocol,
but also is utilized by wide variety of services. Some of the services include e-mail, Chat applications,
FTP applications and Virtual Private Networks (VPN).
Choice of ciphers used has become critical as they ensure safety of data exchanged between client and
server. Making a mistake in choosing ciphers would bring in a false sense of security. Intruders can
successfully decrypt or gain access to sensitive information when choice of ciphers used for secure
communication includes outdated ciphers which are prone to different kind of attacks.
Key points to be considered while securing SSL layer,
SSL 2.0 and SSL 3.0 should be disabled
Weak ciphers like DES , 3DES, RC4 or MD5 should not be used
Removing legacy ciphers from Cipher group using Configuration utility
Legacy ciphers that use DES, 3DES, RC4 or MD5 can be removed from NetScaler by two ways. They can
either be removed from cipher group or they can be removed from SSL profile.
Step1:
Configuration tab -> Traffic Management -> SSL -> Select “Cipher Groups”
Step2:
Select DEFAULT cipher groups -> click Add
Edit the Cipher Group Name to anything else but “Default”
Check for the below list of SSL3, DES, 3DES, MD5, RC4 ciphers and remove them from the group
Step3:
Click create. You will have a list of ciphers from default cipher group without legacy ciphers.
To add the new cipher group to vserver
The below mentioned link gives detailed explanation of how to add user defined cipher groups to
vserver.
http://docs.citrix.com/en-us/netscaler/10-1/ns-tmg-wrapper-10-con/ns-ssl-wrapper-con-10/ns-sslcustomize-ssl-config-con/ns-ssl-user-defined-cipher-groups-tsk.html
Removing legacy ciphers from SSL Profile using Configuration utility
Step1: Configuration tab -> System -> Profiles -> SSL Profle Tab -> <profile name to be modified> ->
Edit
Step2: Select SSL Ciphers -> Add -> Select Cipher -> uncheck SSL3, DES, MD5, RC4 Ciphers -> Move the
selected ones under configured
Step3: After moving list of Ciphers to Configured, select OK and save the configuration.
After the above mentioned steps, SSL profile will not have legacy ciphers.
Disable SSL2.0 and SSL3.0 in NetScaler
To disable SSL 3.0/2.0 on a vserver
The below mentioned cli in command prompt will disable SSL 3.0/SSL2.0 on a vserver
> set ssl vserver vpn -ssl3 DISABLED
> set ssl vserver vpn –ssl2 DISABLED
To disable SSL 3.0/2.0 on SNIP
To disable SSL 3.0/2.0 for a SNIP, internal services on the IP should be identified using following
command
>show service –internal | grep <IP>
Internal services resides inside NetScaler and takes action on behalf of NetScaler. For eg. An internal
service, nshttps-<SNIP IP Address>-443 services SSL connections for the SNIP on NetScaler.
Using the internal service name on the IP, SSL 3.0/2.0 can be disabled using “set ssl service <internal
service name for that ip> -ssl3 disabled” and “set ssl service <internal service name for that ip> -ssl2
disabled”
To disable SSL 3.0/2.0 on NetScaler Management Interface
“nshttps-127.0.0.1-443” is the service running on NetScaler Management Interface.
>show service –internal | grep nshttps-127.0.0.1-443
>set ssl service nshttps-127.0.0.1-443 –ssl2 DISABLED
>set ssl service nshttps-127.0.0.1-443 –ssl3 DISABLED
Using the above mentioned commands , SSL2.0 SSL3.0 can be disabled.
">
