PowerProtect Data Manager: TLS or SSL Weak Message Authentication Code Cipher Suites for ports 8445, 8453, 8761, and 5671
Summary: TLS or SSL Weak Message Authentication Code Cipher Suites are detected on PowerProtect Data Manager appliance for ports 8445, 8453, 8761, and 5671 because the firewall is shut down.
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Symptoms
The below weak ciphers for ports 8445, 8453, 8761, and 5671 are detected on the PowerProtect Data Manager appliance.
Port 8445 is for CBS service, port 8453 is for sysmgr service, port 8761 is for Eureka service, and port 5671 is for RabbitMQ.
| Asset IP Address | Service Port | Vulnerability Title | Vulnerability Proof | Vulnerability Test Result Code | Vulnerability ID |
|---|---|---|---|---|---|
| 10.0.0.1 | 5671 | TLS Server Supports TLS version 1.0 | Successfully connected over TLS v1.0 | Ve | tlsv1_0-enabled |
| 10.0.0.1 | 5671 | TLS Server Supports TLS version 1.1 | Successfully connected over TLS v1.1 | Ve | tlsv1_1-enabled |
| 10.0.0.1 | 8445 | TLS/SSL Weak Message Authentication Code Cipher Suites | * Negotiated with the following insecure cipher suites:
* TLS 1.2 ciphers: * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA |
Ve | ssl-weak-message-authentication-code-algorithms |
| 10.0.0.1 | 8453 | TLS/SSL Weak Message Authentication Code Cipher Suites | * Negotiated with the following insecure cipher suites:
* TLS 1.2 ciphers: * TLS_DHE_RSA_WITH_AES_128_CBC_SHA * TLS_DHE_RSA_WITH_AES_256_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA |
Ve | ssl-weak-message-authentication-code-algorithms |
| 10.0.0.1 | 8761 | TLS/SSL Weak Message Authentication Code Cipher Suites | * Negotiated with the following insecure cipher suites:
* TLS 1.2 ciphers: * TLS_DHE_RSA_WITH_AES_128_CBC_SHA * TLS_DHE_RSA_WITH_AES_256_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA |
Ve | ssl-weak-message-authentication-code-algorithms |
| 10.0.0.1 | 5671 | TLS/SSL Weak Message Authentication Code Cipher Suites | * Negotiated with the following insecure cipher suites:
* TLS 1.0 ciphers: * TLS_DHE_RSA_WITH_AES_128_CBC_SHA * TLS_DHE_RSA_WITH_AES_256_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA * TLS 1.1 ciphers: * TLS_DHE_RSA_WITH_AES_128_CBC_SHA * TLS_DHE_RSA_WITH_AES_256_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA * TLS 1.2 ciphers: * TLS_DHE_RSA_WITH_AES_128_CBC_SHA * TLS_DHE_RSA_WITH_AES_256_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA |
Ve | ssl-weak-message-authentication-code-algorithms |
Port 8445 is for CBS service, port 8453 is for sysmgr service, port 8761 is for Eureka service, and port 5671 is for RabbitMQ.
ppdm:~ # ss -ltnup | grep 8445
tcp LISTEN 0 100 *:8445 *:* users:(("java",pid=123515,fd=535))
ppdm:~ # ps -eaf | grep 123515
root 103022 102210 0 14:40 pts/0 00:00:00 grep --color=auto 123515
admin 123515 1 0 Jul03 ? 01:00:37 /usr/bin/java -Dcomp.name=cbs -XX:+UseParallelGC -XX:MinHeapFreeRatio=20 -XX:MaxHeapFreeRatio=40 -XX:+HeapDumpOnOutOfMemoryError -XX:+ExitOnOutOfMemoryError -XX:HeapDumpPath=/var/log/brs/cbs -Xlog:gc:file=/var/log/brs/cbs/jvm-gc-cbs.log:utctime:filecount=10,filesize=1M -Xms128m -Xmx768m -Dapp.name=cbs -Dapp.repo=/usr/local/brs/lib/cbs/lib -Dapp.home=/usr/local/brs/lib/cbs -Dlog.dir=/var/log/brs/cbs -Dbasedir=/usr/local/brs/lib/cbs -Dlogging.config=config/logback.xml -Dthin.offline -Dthin.root=/usr/local/brs/lib/mvnrepo -Dthin.repo=file:///usr/local/brs/lib/mvnrepo -Dppdm.jar=lib/cbs-core.jar -Xshare:auto -XX:SharedArchiveFile=../share/appcds.jsa -classpath . com.emc.brs.ThinJarLauncher
ppdm:~ # ss -ltnup | grep 8453
tcp LISTEN 0 100 *:8453 *:* users:(("java",pid=112497,fd=646))
ppdm:~ # ps -eaf | grep 112497
sysadmin 104166 112497 0 14:40 ? 00:00:00 /bin/bash /usr/local/brs/lib/cloudmgr/bin/cloudmgr status
root 104177 102210 0 14:40 pts/0 00:00:00 grep --color=auto 112497
sysadmin 112497 1 0 Jul03 ? 02:54:41 /usr/bin/java -Dcomp.name=sysmgr -XX:+UseParallelGC -XX:MinHeapFreeRatio=20 -XX:MaxHeapFreeRatio=40 -XX:+HeapDumpOnOutOfMemoryError -XX:+ExitOnOutOfMemoryError -XX:HeapDumpPath=/var/log/brs/sysmgr -Xlog:gc:file=/var/log/brs/sysmgr/jvm-gc-sysmgr.log:utctime:filecount=10,filesize=1M -Xms128m -Xmx512m -Dapp.name=sysmgr -Dapp.repo=/usr/local/brs/lib/sysmgr/lib -Dapp.home=/usr/local/brs/lib/sysmgr -Dlog.dir=/var/log/brs/sysmgr -Dbasedir=/usr/local/brs/lib/sysmgr -Dlogging.config=config/logback.xml -Dthin.offline -Dthin.root=/usr/local/brs/lib/mvnrepo -Dthin.repo=file:///usr/local/brs/lib/mvnrepo -Dppdm.jar=lib/sysmgr-core.jar -Xshare:auto -XX:SharedArchiveFile=../share/appcds.jsa -classpath . com.emc.brs.ThinJarLauncher
ppdm:~ # ss -ltnup | grep 8761
tcp LISTEN 0 100 *:8761 *:* users:(("java",pid=110565,fd=120))
ppdm:~ # ps -eaf | grep 110565
root 104760 102210 0 14:41 pts/0 00:00:00 grep --color=auto 110565
admin 110565 1 0 Jul03 ? 00:31:32 /usr/bin/java -Dcomp.name=eureka -XX:+UseParallelGC -XX:MinHeapFreeRatio=20 -XX:MaxHeapFreeRatio=40 -XX:+HeapDumpOnOutOfMemoryError -XX:+ExitOnOutOfMemoryError -XX:HeapDumpPath=/var/log/brs/eureka -Xlog:gc:file=/var/log/brs/eureka/jvm-gc-eureka.log:utctime:filecount=10,filesize=1M -Xms64m -Xmx128m -Dapp.name=eureka -Dapp.repo=/usr/local/brs/lib/eureka/lib -Dapp.home=/usr/local/brs/lib/eureka -Dlog.dir=/var/log/brs/eureka -Dbasedir=/usr/local/brs/lib/eureka -Dlogging.config=config/logback.xml -Dthin.offline -Dthin.root=/usr/local/brs/lib/mvnrepo -Dthin.repo=file:///usr/local/brs/lib/mvnrepo -Dppdm.jar=lib/eureka-service.jar -Xshare:auto -XX:SharedArchiveFile=../share/appcds.jsa -classpath . com.emc.brs.ThinJarLauncher
ppdm:~ # ss -ltnup | grep 5671
tcp LISTEN 0 128 *:5671 *:* users:(("beam.smp",pid=111379,fd=85))
ppdm:~ # ps -eaf | grep 111379
root 107275 102210 0 14:42 pts/0 00:00:00 grep --color=auto 111379
rabbitmq 111379 1 0 Jul03 ? 04:04:00 /usr/local/lib/erlang/erts-14.2.1/bin/beam.smp -W w -MBas ageffcbf -MHas ageffcbf -MBlmbcs 512 -MHlmbcs 512 -MMmcs 30 -pc unicode -P 1048576 -t 5000000 -stbt db -zdbbl 128000 -sbwt none -sbwtdcpu none -sbwtdio none -- -root /usr/local/lib/erlang -bindir /usr/local/lib/erlang/erts-14.2.1/bin -progname erl -- -home /var/lib/rabbitmq -- -pa -noshell -noinput -s rabbit boot -boot start_sasl -syslog logger [] -syslog syslog_error_logger false -kernel prevent_overlapping_partitions false -enable-feature maybe_expr
rabbitmq 111393 111379 0 Jul03 ? 00:00:05 erl_child_setup 32768Cause
The firewall protects the above-mentioned ports and is not supposed to be exposed to the external traffic. The user should not be able to connect to these ports without shutting down the firewall on the PowerProtect Data Manager appliance.
Resolution
On PowerProtect Data Manager 19.15 and later
- Check the firewall status
service firewalld status
iptables -nvL
- Start the firewall
service firewalld start
On PowerProtect Data Manager 19.14 and earlier
- Check the firewall status
service SuSEfirewall2 status
iptables -nvL
- Start the firewall
service SuSEfirewall2 start
Affected Products
PowerProtect Data Manager ApplianceArticle Properties
Article Number: 000227549
Article Type: Solution
Last Modified: 21 May 2026
Version: 4
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.