Secure AEM against various SSL / TLS vulnerabilities | AEM 6.x

Cerca
Experience Manager Guida utente

Su questa pagina

Prodotti interessati: Experience Manager
How do we protect AEM's https port against newer SSL / TLS security vulnerabilities? For example, LOGJAM or SWEET32.

Environment

AEM 6.x

Steps

To protect against various SSL vulnerabilities on an AEM instance's HTTPS port, follow the steps below.

  1. Log in to your AEM server and add the JVM parameter below to the java command:

    -Djdk.tls.ephemeralDHKeySize=2048

    If you are using the out of the box crx-quickstart/bin/start script, then this is done by adding the variable above to the CQ_JVM_OPTS variable.

  2. Restart AEM after adding the JVM option.  You can validate that the JVM option / system property was picked up on this screen https://aem-host:port/system/console/jmx/java.lang%3Atype%3DRuntime.  Search the page and validate that the property jdk.tls.ephemeralDHKeySize is now set to 2048.

  3. If you have https support configured, then go to https://aem-host:port/crx/de/index.jsp and log in as admin.

  4. Browse to /apps/system/config/org.apache.felix.http.config.

  5. Modify the configuration file.  Replace the four configuration properties listed below in the file with the values provided [1].  If a variable does not exist in your configuration, then copy it to the end of the configuration file.  

    • org.apache.felix.https.jetty.ciphersuites.excluded
    • org.apache.felix.https.jetty.ciphersuites.included
    • org.apache.felix.https.jetty.protocols.excluded
    • org.apache.felix.https.jetty.protocols.included

    A sample configuration file is provided below [2].

  6. Click Save All. 

  7. After applying the updated configuration, validate that the configuration took effect.  Go to this URL https://aem-host:port/system/console/configMgr/org.apache.felix.http.config and review the configuration to see that the property values were carried over.

  8. Use a tool like testssh.sh to validate that the system is no longer vulnerable.

Additional information

It is recommended to configure your systems with optimal security to access AEM instance directly. [1]

org.apache.felix.https.jetty.ciphersuites.excluded=[\
"SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",\
"SSL_DHE_DSS_WITH_AES_128_CBC_SHA",\
"SSL_DHE_DSS_WITH_AES_256_CBC_SHA",\
"SSL_DHE_DSS_WITH_DES_CBC_SHA",\
"SSL_DHE_DSS_WITH_RC4_128_SHA",\
"SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",\
"SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA",\
"SSL_DHE_RSA_WITH_AES_128_CBC_SHA",\
"SSL_DHE_RSA_WITH_AES_256_CBC_SHA",\
"SSL_DHE_RSA_WITH_DES_CBC_SHA",\
"SSL_RSA_EXPORT_WITH_DES40_CBC_SHA",\
"SSL_RSA_EXPORT_WITH_RC4_40_MD5",\
"SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA",\
"SSL_RSA_FIPS_WITH_DES_EDE_CBC_SHA",\
"SSL_RSA_WITH_DES_CBC_SHA",\
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA",\
"TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_DH_anon_WITH_3DES_EDE_CBC_SHA",\
"TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",\
"TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",\
"PCT_SSL_CIPHER_TYPE_1ST_HALF",\
"SSL_DH_anon_EXPORT_WITH_RC4_40_MD5",\
"SSL_DH_anon_WITH_RC4_128_MD5",\
"SSL_RSA_EXPORT_WITH_RC4_40_MD5",\
"SSL_RSA_WITH_RC4_128_MD5",\
"SSL_RSA_WITH_RC4_128_SHA",\
"SSL2_RC4_128_EXPORT40_WITH_MD5",\
"SSL2_RC4_128_WITH_MD5",\
"SSL2_RC4_64_WITH_MD5",\
"TLS_DH_Anon_EXPORT_WITH_RC4_40_MD5",\
"TLS_DH_Anon_WITH_RC4_128_MD5",\
"TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA",\
"TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA256",\
"TLS_DHE_DSS_WITH_RC4_128_SHA",\
"TLS_DHE_DSS_WITH_RC4_128_SHA256",\
"TLS_DHE_PSK_WITH_RC4_128_SHA",\
"TLS_DHE_PSK_WITH_RC4_128_SHA256",\
"TLS_ECDH_Anon_WITH_RC4_128_SHA",\
"TLS_ECDH_Anon_WITH_RC4_128_SHA256",\
"TLS_ECDH_ECDSA_WITH_RC4_128_SHA",\
"TLS_ECDH_ECDSA_WITH_RC4_128_SHA256",\
"TLS_ECDH_RSA_WITH_RC4_128_SHA",\
"TLS_ECDH_RSA_WITH_RC4_128_SHA256",\
"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",\
"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA256",\
"TLS_ECDHE_PSK_WITH_RC4_128_SHA",\
"TLS_ECDHE_PSK_WITH_RC4_128_SHA256",\
"TLS_ECDHE_RSA_WITH_RC4_128_SHA",\
"TLS_ECDHE_RSA_WITH_RC4_128_SHA256",\
"TLS_KRB5_EXPORT_WITH_RC4_40_MD5",\
"TLS_KRB5_EXPORT_WITH_RC4_40_SHA",\
"TLS_KRB5_EXPORT_WITH_RC4_40_SHA256",\
"TLS_KRB5_WITH_RC4_128_MD5",\
"TLS_KRB5_WITH_RC4_128_SHA",\
"TLS_KRB5_WITH_RC4_128_SHA256",\
"TLS_PSK_WITH_RC4_128_SHA",\
"TLS_PSK_WITH_RC4_128_SHA256",\
"TLS_RSA_EXPORT_WITH_RC4_40_MD5",\
"TLS_RSA_EXPORT1024_WITH_RC4_56_MD5",\
"TLS_RSA_EXPORT1024_WITH_RC4_56_SHA",\
"TLS_RSA_EXPORT1024_WITH_RC4_56_SHA256",\
"TLS_RSA_PSK_WITH_RC4_128_SHA",\
"TLS_RSA_PSK_WITH_RC4_128_SHA256",\
"TLS_RSA_WITH_RC4_128_MD5",\
"TLS_RSA_WITH_RC4_128_SHA",\
"TLS_RSA_WITH_RC4_128_SHA256",\
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",\
".*3DES_EDE_CBC.*"\
]
org.apache.felix.https.jetty.ciphersuites.included=[ \
  "", \
  ]
org.apache.felix.https.jetty.protocols.excluded=[ \
  "SSLv3", \
  "SSL", \
  "SSLv2", \
  "SSLv2Hello", \
  "TLSv1.0", \
  "TLSv1.1", \
  ]
org.apache.felix.https.jetty.protocols.included=[ \
  "TLSv1.2"
  ]

[2] Sample of /apps/system/config/org.apache.felix.http.config

# Configuration created by Apache Sling JCR Installer
org.apache.felix.http.timeout=I"60000"
org.apache.felix.http.jetty.acceptors=I"-1"
org.apache.felix.https.clientcertificate="none"
org.apache.felix.https.jetty.protocols.excluded=["SSLv3","SSL","SSLv2","SSLv2Hello","TLSv1.0","TLSv1.1"]
org.apache.felix.http.jetty.threadpool.max=I"-1"
org.osgi.service.http.port=I"4504"
org.eclipse.jetty.servlet.CheckingRemoteSessionIdEncoding=B"true"
org.apache.felix.http.enable=B"true"
org.apache.felix.https.jetty.protocols.included=["TLSv1.2"]
org.apache.felix.https.keystore="/opt/aem/author62/crx-quickstart/ssl/keystorename.keystore"
org.apache.felix.https.jetty.ciphersuites.excluded=[\
"SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",\
"SSL_DHE_DSS_WITH_AES_128_CBC_SHA",\
"SSL_DHE_DSS_WITH_AES_256_CBC_SHA",\
"SSL_DHE_DSS_WITH_DES_CBC_SHA",\
"SSL_DHE_DSS_WITH_RC4_128_SHA",\
"SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",\
"SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA",\
"SSL_DHE_RSA_WITH_AES_128_CBC_SHA",\
"SSL_DHE_RSA_WITH_AES_256_CBC_SHA",\
"SSL_DHE_RSA_WITH_DES_CBC_SHA",\
"SSL_RSA_EXPORT_WITH_DES40_CBC_SHA",\
"SSL_RSA_EXPORT_WITH_RC4_40_MD5",\
"SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA",\
"SSL_RSA_FIPS_WITH_DES_EDE_CBC_SHA",\
"SSL_RSA_WITH_DES_CBC_SHA",\
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA",\
"TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_DH_anon_WITH_3DES_EDE_CBC_SHA",\
"TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",\
"TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",\
"PCT_SSL_CIPHER_TYPE_1ST_HALF",\
"SSL_DH_anon_EXPORT_WITH_RC4_40_MD5",\
"SSL_DH_anon_WITH_RC4_128_MD5",\
"SSL_RSA_EXPORT_WITH_RC4_40_MD5",\
"SSL_RSA_WITH_RC4_128_MD5",\
"SSL_RSA_WITH_RC4_128_SHA",\
"SSL2_RC4_128_EXPORT40_WITH_MD5",\
"SSL2_RC4_128_WITH_MD5",\
"SSL2_RC4_64_WITH_MD5",\
"TLS_DH_Anon_EXPORT_WITH_RC4_40_MD5",\
"TLS_DH_Anon_WITH_RC4_128_MD5",\
"TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA",\
"TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA256",\
"TLS_DHE_DSS_WITH_RC4_128_SHA",\
"TLS_DHE_DSS_WITH_RC4_128_SHA256",\
"TLS_DHE_PSK_WITH_RC4_128_SHA",\
"TLS_DHE_PSK_WITH_RC4_128_SHA256",\
"TLS_ECDH_Anon_WITH_RC4_128_SHA",\
"TLS_ECDH_Anon_WITH_RC4_128_SHA256",\
"TLS_ECDH_ECDSA_WITH_RC4_128_SHA",\
"TLS_ECDH_ECDSA_WITH_RC4_128_SHA256",\
"TLS_ECDH_RSA_WITH_RC4_128_SHA",\
"TLS_ECDH_RSA_WITH_RC4_128_SHA256",\
"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",\
"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA256",\
"TLS_ECDHE_PSK_WITH_RC4_128_SHA",\
"TLS_ECDHE_PSK_WITH_RC4_128_SHA256",\
"TLS_ECDHE_RSA_WITH_RC4_128_SHA",\
"TLS_ECDHE_RSA_WITH_RC4_128_SHA256",\
"TLS_KRB5_EXPORT_WITH_RC4_40_MD5",\
"TLS_KRB5_EXPORT_WITH_RC4_40_SHA",\
"TLS_KRB5_EXPORT_WITH_RC4_40_SHA256",\
"TLS_KRB5_WITH_RC4_128_MD5",\
"TLS_KRB5_WITH_RC4_128_SHA",\
"TLS_KRB5_WITH_RC4_128_SHA256",\
"TLS_PSK_WITH_RC4_128_SHA",\
"TLS_PSK_WITH_RC4_128_SHA256",\
"TLS_RSA_EXPORT_WITH_RC4_40_MD5",\
"TLS_RSA_EXPORT1024_WITH_RC4_56_MD5",\
"TLS_RSA_EXPORT1024_WITH_RC4_56_SHA",\
"TLS_RSA_EXPORT1024_WITH_RC4_56_SHA256",\
"TLS_RSA_PSK_WITH_RC4_128_SHA",\
"TLS_RSA_PSK_WITH_RC4_128_SHA256",\
"TLS_RSA_WITH_RC4_128_MD5",\
"TLS_RSA_WITH_RC4_128_SHA",\
"TLS_RSA_WITH_RC4_128_SHA256",\
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",\
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",\
".*3DES_EDE_CBC.*"\
]
org.apache.felix.http.path_exclusions=["/system"]
org.apache.felix.http.jetty.selectors=I"-1"
org.apache.felix.proxy.load.balancer.connection.enable=B"true"
org.eclipse.jetty.servlet.SessionDomain=""
org.apache.felix.https.jetty.renegotiateAllowed=B"false"
org.apache.felix.http.jetty.maxFormSize=I"204800"
org.apache.felix.http.jetty.sendServerHeader=B"false"
org.apache.felix.http.jetty.requestBufferSize=I"8192"
org.apache.felix.https.keystore.password="storepassword"
org.eclipse.jetty.servlet.SessionIdPathParameterName="jsessionid"
org.apache.felix.https.jetty.ciphersuites.included=[""]
org.apache.felix.http.mbeans=B"false"
org.apache.felix.http.host="0.0.0.0"
org.eclipse.jetty.servlet.SessionCookie="JSESSIONID"
org.eclipse.jetty.servlet.SessionPath=""
org.osgi.service.http.port.secure=I"54333"
org.apache.felix.https.jetty.session.cookie.httpOnly=B"true"
org.apache.felix.http.context_path="/"
org.apache.felix.https.enable=B"true"
org.apache.felix.https.keystore.key.password="key_password"
org.apache.felix.http.jetty.headerBufferSize=I"16384"
org.apache.felix.https.truststore=""
org.apache.felix.http.session.timeout=I"10"
org.eclipse.jetty.servlet.MaxAge=I"-1"
org.apache.felix.https.jetty.session.cookie.secure=B"false"
org.apache.felix.http.jetty.responseBufferSize=I"24576"

Questo prodotto è concesso in licenza in base alla licenza di Attribuzione-Non commerciale-Condividi allo stesso modo 3.0 Unported di Creative Commons.  I post su Twitter™ e Facebook non sono coperti dai termini di Creative Commons.

Note legali   |   Informativa sulla privacy online

Scegli l'area geografica

La selezione di un'area geografica cambia la lingua e/o il contenuto su Adobe.com.

Americas
Brasil
Canada - English
Canada - Français
Latinoamérica
México
United States
Europe, Middle East and Africa
Africa - English
België
Belgique
Belgium - English
Česká republika
Cyprus - English
Danmark
Deutschland
Eesti
España
France
Greece - English
Ireland
Israel - English
Italia
Latvija
Lietuva
Luxembourg - Deutsch
Luxembourg - English
Luxembourg - Français
Magyarország
Malta - English
Middle East and North Africa - English
Nederland
Norge
Österreich
Polska
Portugal
România
Schweiz
Slovenija
Slovensko
Suisse
Suomi
Sverige
Svizzera
Türkiye
United Kingdom
България
Россия
Україна
الشرق الأوسط وشمال أفريقيا - اللغة العربية
ישראל - עברית
Asia - Pacific
Australia
Hong Kong S.A.R. of China
India - English
New Zealand
Southeast Asia (Includes Indonesia, Malaysia, Philippines, Singapore, Thailand, and Vietnam) - English
中国
中國香港特別行政區
台灣地區
日本
한국
Commonwealth of Independent States
Includes Armenia, Azerbaijan, Belarus, Georgia, Kazakhstan, Kyrgyzstan, Moldova, Tajikistan, Turkmenistan, Ukraine, Uzbekistan