PowerProtect Data Manager: TLS or SSL Weak Message Authentication Code Cipher Suites for ports 8445, 8453, 8761, and 5671

Summary: TLS or SSL Weak Message Authentication Code Cipher Suites are detected on PowerProtect Data Manager appliance for ports 8445, 8453, 8761, and 5671 because the firewall is shut down.

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.

Symptoms

The below weak ciphers for ports 8445, 8453, 8761, and 5671 are detected on the PowerProtect Data Manager appliance.
 
Asset IP Address Service Port Vulnerability Title Vulnerability Proof Vulnerability Test Result Code Vulnerability ID
10.0.0.1 5671 TLS Server Supports TLS version 1.0 Successfully connected over TLS v1.0 Ve tlsv1_0-enabled
10.0.0.1 5671 TLS Server Supports TLS version 1.1 Successfully connected over TLS v1.1 Ve tlsv1_1-enabled
10.0.0.1 8445 TLS/SSL Weak Message Authentication Code Cipher Suites * Negotiated with the following insecure cipher suites:
* TLS 1.2 ciphers:
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ve ssl-weak-message-authentication-code-algorithms
10.0.0.1 8453 TLS/SSL Weak Message Authentication Code Cipher Suites * Negotiated with the following insecure cipher suites:
* TLS 1.2 ciphers:
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ve ssl-weak-message-authentication-code-algorithms
10.0.0.1 8761 TLS/SSL Weak Message Authentication Code Cipher Suites * Negotiated with the following insecure cipher suites:
* TLS 1.2 ciphers:
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ve ssl-weak-message-authentication-code-algorithms
10.0.0.1 5671 TLS/SSL Weak Message Authentication Code Cipher Suites * Negotiated with the following insecure cipher suites:
* TLS 1.0 ciphers:
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
* TLS 1.1 ciphers:
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
* TLS 1.2 ciphers:
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ve ssl-weak-message-authentication-code-algorithms

Port 8445 is for CBS service, port 8453 is for sysmgr service, port 8761 is for Eureka service, and port 5671 is for RabbitMQ.
ppdm:~ # ss -ltnup | grep 8445
tcp   LISTEN 0      100                        *:8445             *:*    users:(("java",pid=123515,fd=535))                                                                                                                                                                                                 
ppdm:~ # ps -eaf | grep 123515
root     103022 102210  0 14:40 pts/0    00:00:00 grep --color=auto 123515
admin    123515      1  0 Jul03 ?        01:00:37 /usr/bin/java -Dcomp.name=cbs -XX:+UseParallelGC -XX:MinHeapFreeRatio=20 -XX:MaxHeapFreeRatio=40 -XX:+HeapDumpOnOutOfMemoryError -XX:+ExitOnOutOfMemoryError -XX:HeapDumpPath=/var/log/brs/cbs -Xlog:gc:file=/var/log/brs/cbs/jvm-gc-cbs.log:utctime:filecount=10,filesize=1M -Xms128m -Xmx768m -Dapp.name=cbs -Dapp.repo=/usr/local/brs/lib/cbs/lib -Dapp.home=/usr/local/brs/lib/cbs -Dlog.dir=/var/log/brs/cbs -Dbasedir=/usr/local/brs/lib/cbs -Dlogging.config=config/logback.xml -Dthin.offline -Dthin.root=/usr/local/brs/lib/mvnrepo -Dthin.repo=file:///usr/local/brs/lib/mvnrepo -Dppdm.jar=lib/cbs-core.jar -Xshare:auto -XX:SharedArchiveFile=../share/appcds.jsa -classpath . com.emc.brs.ThinJarLauncher

ppdm:~ # ss -ltnup | grep 8453
tcp   LISTEN 0      100                        *:8453             *:*    users:(("java",pid=112497,fd=646))                                                                                                                                                                                                 
ppdm:~ # ps -eaf | grep 112497
sysadmin 104166 112497  0 14:40 ?        00:00:00 /bin/bash /usr/local/brs/lib/cloudmgr/bin/cloudmgr status
root     104177 102210  0 14:40 pts/0    00:00:00 grep --color=auto 112497
sysadmin 112497      1  0 Jul03 ?        02:54:41 /usr/bin/java -Dcomp.name=sysmgr -XX:+UseParallelGC -XX:MinHeapFreeRatio=20 -XX:MaxHeapFreeRatio=40 -XX:+HeapDumpOnOutOfMemoryError -XX:+ExitOnOutOfMemoryError -XX:HeapDumpPath=/var/log/brs/sysmgr -Xlog:gc:file=/var/log/brs/sysmgr/jvm-gc-sysmgr.log:utctime:filecount=10,filesize=1M -Xms128m -Xmx512m -Dapp.name=sysmgr -Dapp.repo=/usr/local/brs/lib/sysmgr/lib -Dapp.home=/usr/local/brs/lib/sysmgr -Dlog.dir=/var/log/brs/sysmgr -Dbasedir=/usr/local/brs/lib/sysmgr -Dlogging.config=config/logback.xml -Dthin.offline -Dthin.root=/usr/local/brs/lib/mvnrepo -Dthin.repo=file:///usr/local/brs/lib/mvnrepo -Dppdm.jar=lib/sysmgr-core.jar -Xshare:auto -XX:SharedArchiveFile=../share/appcds.jsa -classpath . com.emc.brs.ThinJarLauncher

ppdm:~ # ss -ltnup | grep 8761
tcp   LISTEN 0      100                        *:8761             *:*    users:(("java",pid=110565,fd=120))                                                                                                                                                                                                 
ppdm:~ # ps -eaf | grep 110565
root     104760 102210  0 14:41 pts/0    00:00:00 grep --color=auto 110565
admin    110565      1  0 Jul03 ?        00:31:32 /usr/bin/java -Dcomp.name=eureka -XX:+UseParallelGC -XX:MinHeapFreeRatio=20 -XX:MaxHeapFreeRatio=40 -XX:+HeapDumpOnOutOfMemoryError -XX:+ExitOnOutOfMemoryError -XX:HeapDumpPath=/var/log/brs/eureka -Xlog:gc:file=/var/log/brs/eureka/jvm-gc-eureka.log:utctime:filecount=10,filesize=1M -Xms64m -Xmx128m -Dapp.name=eureka -Dapp.repo=/usr/local/brs/lib/eureka/lib -Dapp.home=/usr/local/brs/lib/eureka -Dlog.dir=/var/log/brs/eureka -Dbasedir=/usr/local/brs/lib/eureka -Dlogging.config=config/logback.xml -Dthin.offline -Dthin.root=/usr/local/brs/lib/mvnrepo -Dthin.repo=file:///usr/local/brs/lib/mvnrepo -Dppdm.jar=lib/eureka-service.jar -Xshare:auto -XX:SharedArchiveFile=../share/appcds.jsa -classpath . com.emc.brs.ThinJarLauncher

ppdm:~ # ss -ltnup | grep 5671
tcp   LISTEN 0      128                        *:5671             *:*    users:(("beam.smp",pid=111379,fd=85))                                                                                                                                                                                              
ppdm:~ # ps -eaf | grep 111379
root     107275 102210  0 14:42 pts/0    00:00:00 grep --color=auto 111379
rabbitmq 111379      1  0 Jul03 ?        04:04:00 /usr/local/lib/erlang/erts-14.2.1/bin/beam.smp -W w -MBas ageffcbf -MHas ageffcbf -MBlmbcs 512 -MHlmbcs 512 -MMmcs 30 -pc unicode -P 1048576 -t 5000000 -stbt db -zdbbl 128000 -sbwt none -sbwtdcpu none -sbwtdio none -- -root /usr/local/lib/erlang -bindir /usr/local/lib/erlang/erts-14.2.1/bin -progname erl -- -home /var/lib/rabbitmq -- -pa  -noshell -noinput -s rabbit boot -boot start_sasl -syslog logger [] -syslog syslog_error_logger false -kernel prevent_overlapping_partitions false -enable-feature maybe_expr
rabbitmq 111393 111379  0 Jul03 ?        00:00:05 erl_child_setup 32768

Cause

The firewall protects the above-mentioned ports and is not supposed to be exposed to the external traffic. The user should not be able to connect to these ports without shutting down the firewall on the PowerProtect Data Manager appliance.

Resolution

On PowerProtect Data Manager 19.15 and later

  1. Check the firewall status
    service firewalld status
    iptables -nvL
  2. Start the firewall
    service firewalld start

​​​​​​
On PowerProtect Data Manager 19.14 and earlier

  1. Check the firewall status
    service SuSEfirewall2 status
    iptables -nvL
  2. Start the firewall
    service SuSEfirewall2 start

Affected Products

PowerProtect Data Manager Appliance
Article Properties
Article Number: 000227549
Article Type: Solution
Last Modified: 21 May 2026
Version:  4
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.