Before i begin with my securing article, i want to say something on security on IBM Connections. Mainly i don’t like the thing, that IBM only support very special versions of software.
So we must use WebSphere 220.127.116.11, DB2 18.104.22.168, IHS 22.214.171.124 and so on. Each product had updates the last months and i think we won’t get support when we use other versions.
So i have to chances. On the first side i can update my software to limit vulnerabilities and get perhaps no support, or i will have vulerable software with support.
Just my 2 cent and i hope i will get answer, if i will get support with higher program versions.
SSL and IHS
One of our customers had a pentest the last months and had some vulnerabilities with IBM HTTP Server (IHS), which is used to access IBM Connections.
I used a 2048 Bit key for ssl which was generated with iKeyman, but the pentest doc told me, that short keys were used for encryption (smaller 112 bit). So i read a little bit.
This 2048 bit mean the public key of my hostkey. SSL uses this key to encrypt the connection between browser and webserver. Within the ssl handshake session keys are generated on basis of this hostkey. Browser and Server check which protocols are enabled on both sides and use one of the protocols both support.
You can check your SSL enabled server here: https://www.ssllabs.com/ssltest/index.html.
Information on ciphers with IHS: http://www-01.ibm.com/software/webservers/httpservers/doc/v10/ibm/9acdciph.htm
You can limit the available ciphers and protocols on your IBM HTTP Server.
First you should disable SSL v2: SSLProtocolDisable SSLv2
I configure the directives in my virtual hosts section:
Listen 0.0.0.0:443 ServerName connections.example.com SSLEnable SSLProtocolDisable SSLv2 SSLCipherSpec 3A SSLCipherSpec 34 SSLCipherSpec 35 SSLCipherSpec 2F SSLCipherSpec 35b
Poorly TLS v1.1 and v1.2 support comes with IHS 8 and we can’t use it with IHS 7.
This is my first article on securing IHS and Connections. Next part will continue with IHS, i want to disable some parts, which comes with the default httpd.conf and are not used with connections.