Dell Unity: Nessus Full Safe Vulnerability Security Scan TLS Version 1.0 Protocol Detection (kan korrigeras av användaren)

Följande artikel 000022527 
Dell Unity: Avaktivera TLS 1.0 och 1.1 på Unity Array (kan korrigeras av användaren).  Nessus upptäckte dock en TLS-sårbarhet på port 5085.
Upptäckta sårbarheter:https://www.tenable.com/plugins/nessus/104743
Plugin-program:

104743 Plugin-namn: TLS version 1.0 Protokollidentifieringsport
: Utgång för 5085-insticksprogram
: TLSv1 är aktiverat och servern stöder minst ett chiffer.
Synopsis: Fjärrtjänsten krypterar trafik med hjälp av en äldre version av TLS.
Lösning: Aktivera stöd för TLS 1.2 och 1.3 och inaktivera stöd för TLS 1.0.

Kommandot "uemcli -u admin -password <Your Password> /sys/security set -tlsMode TLSv1.2" inaktiverar endast port 443.
Om du vill inaktivera port 5085 måste du använda alternativet "-param" i kommandot svc_nas.

Inaktivera TLS 1.0 och 1.1 (port 5085) med hjälp av stegen nedan:
1. Kontrollera de aktuella inställningarna.

svc_nas ALL -param -facility ssl -info protocol -v

2. Ändra värdet till "4" = TLSv1.2 och högre".

svc_nas ALL -param -facility ssl -modify protocol -value 4

3. Bekräfta att current_value har ändrats till "4" = TLSv1.2 eller senare.

svc_nas ALL -param -facility ssl -info protocol -v

4. Starta om lagringsprocessorerna en i taget.
UI (Unisphere):
SYSTEM>>> Serviceuppgifter>>>>>>(lagringsprocessor X) Välj Starta om och klicka på Kör.

CLI:

svc_shutdown --reboot [spa | spb] 

5. Bekräfta att current_value har ändrats till "4" = TLSv1.2 och senare.

Example of changing from TLSv1.0 to TLSv1.2 (Port 5085):

1. Check the current settings.
XXXXX spa:~/user# svc_nas ALL -param -facility ssl -info protocol -v

name                    = protocol
facility_name           = ssl
default_value           = 2   <<<
current_value           = 2   <<<
configured_value        =     <<<
param_type              = global
user_action             = reboot SP
change_effective        = reboot SP
range                   = (0,4)
description             = Set the supported SSL/TLS protocols. Possible values are: 0=all SSL/TLS protocols are allowed, 1=SSLv3 and above, 2=TLSv1.0 and above, 3=TLSv1.1 and above, 4=TLSv1.2 and above

2. Change the value to "4" = TLSv1.2 and above".
XXXXX spa:~/user# svc_nas ALL -param -facility ssl -modify protocol -value 4

SPA : done

Warning 17716815750: SPA : You must reboot the SP for protocol changes to take effect.
SPB : done
 
Warning 17716815750: SPB : You must reboot the SP for protocol changes to take effect.

3. Confirm that the configured_value has been changed to "4"=TLSv1.2 and above.
XXXXX spa:~/user# svc_nas ALL -param -facility ssl -info protocol -v

SPA :
name                    = protocol
facility_name           = ssl
default_value           = 2
current_value           = 2　　<<<<　current_value is changed after restart
configured_value        = 4　　<<<<
param_type              = global
user_action             = reboot SP
change_effective        = reboot SP
range                   = (0,4)
description             = Set the supported SSL/TLS protocols. Possible values are: 0=all SSL/TLS protocols are allowed, 1=SSLv3 and above, 2=TLSv1.0 and above, 3=TLSv1.1 and above, 4=TLSv1.2 and above

4. Reboot Storage Processor (both SPs alternately).

5. Confirm that the current_value has been changed to "4"=TLSv1.2 and above.

XXXXX spa:~/user# svc_nas ALL -param -facility ssl -info protocol -v

SPA :
name                    = protocol
facility_name           = ssl
default_value           = 2
current_value           = 4　　<<<< 
configured_value        = 4
param_type              = global
user_action             = reboot SP
change_effective        = reboot SP
range                   = (0,4)
description             = Set the supported SSL/TLS protocols. Possible values are: 0=all SSL/TLS protocols are allowed, 1=SSLv3 and above, 2=TLSv1.0 and above, 3=TLSv1.1 and above, 4=TLSv1.2 and above

Inaktivera TLS 1.0 och 1.1 (port 443). 
Utdrag ur artikel 000022527.
● Unity OE 5.1 och senare matriser med kommandot nedan: Visa de aktuella inställningarna med kommandot:
 

uemcli -u admin -password <Your Password> /sys/security show

Inaktivera TLS 1.0 och 1.1 genom att ange -tlsMode TLSv1.2:

uemcli -u admin -password <Your Password> /sys/security set -tlsMode TLSv1.2

Exempel på hur du byter från TLSv1.0 till TLSv1.2 (Port443):

XXXXX spa:~/user# uemcli -u admin -p Password123# /sys/security show
Storage system address: 127.0.0.1
Storage system port: 443
HTTPS connection

1:    FIPS 140 mode         = disabled
      TLS mode              = TLSv1.0 and above
      Restricted shell mode = enabled

XXXXX spa:~/user# uemcli -u admin -p Password123# /sys/security set -tlsMode TLSv1.2
Storage system address: 127.0.0.1
Storage system port: 443
HTTPS connection

Please refer to the Security Configuration Guide for backward compatibility.
This change may impact running operations (e.g. replication) and the management services will be automatically restarted for the change to take effect.
Do you want to continue?
yes / no: yes
Operation completed successfully.

XXXXX spa:~/user# uemcli -u admin -p Password123# /sys/security show
Storage system address: 127.0.0.1
Storage system port: 443
HTTPS connection

1:    FIPS 140 mode         = disabled
      TLS mode              = TLSv1.2 and above　　<<<
      Restricted shell mode = enabled

Om disksystemet kör OE 4.3 till 5.0 inaktiverar du TLS 1.0 (port 443) med kommandot nedan: Visa de aktuella inställningarna med kommandot:
 

uemcli -u admin -password <Your Password> /sys/security show -detail

Inaktivera TLS 1.0 med kommandot: 

uemcli -u admin -password <Your Password> /sys/security set -tls1Enabled no

Aktivera TLS 1.2 med kommandot: 

uemcli -u admin -password <Your Password> /sys/security -tlsMode TLSv1.2

Exempel på hur du byter från TLSv1.0 till TLSv1.2 (port 443): 

XXXXX spa:~/user# uemcli -u admin -password Password123# /sys/security show -detail
Storage system address: 127.0.0.1
Storage system port: 443
HTTPS connection

1:    FIPS 140 mode         = disabled
      TLS 1.0 mode          = enabled
      TLS mode              = TLSv1.0 and above
      Restricted shell mode = enabled

XXXXX spa:~/user# uemcli -u admin -password Password123# /sys/security set -tlsMode TLSv1.2
Storage system address: 127.0.0.1
Storage system port: 443
HTTPS connection

Please refer to the Security Configuration Guide for backward compatibility.
This change may impact running operations (e.g. replication) and the management services will be automatically restarted for the change to take effect.
Do you want to continue?
yes / no: yes
Operation completed successfully.

XXXXX spa:~/user# uemcli -u admin -password Password123# /sys/security show -detail
Storage system address: 127.0.0.1
Storage system port: 443
HTTPS connection

1:    FIPS 140 mode         = disabled
      TLS 1.0 mode          = disabled               <<<
      TLS mode              = TLSv1.2 and above　　 <<<
      Restricted shell mode = enabled

Notera:Följande "Felkod:
0x1000302" kan visas omedelbart efter att du har ändrat inställningarna.
Om ett fel inträffar, försök att köra kommandot igen efter cirka 5 minuter.

Operation failed. Error code: 0x1000302
Remote server is not available. Please contact server support (Error Code:0x1000302)