openvpn access server Cipher

odoisneau

I am getting SSLv3.0/TLSv1.0 Protocol Weak CBC Mode Vulnerability warnings on my openvpn access servers. The logs show this: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA'.

any way to fix this issue?

Olivier

The Johan

Make sure you're up to date with Access Server 2.0.10 or newer, and then go to the SSL Settings page, and in the web services section there, set the minimum to TLS 1.0. That will effectively disabled SSLv3 and solve the problem you're seeing now.

Access Server versions older than 2.0.8 did not have this option.

M.D. Klapwijk

We ran into the same problem, Qualis/McAffee (PCI-DSS-ASV) external scan is reporting the availability of weak ciphers. We are using Openvpnas 2.0.10 and get the following when using sslscan:
Supported Server Cipher(s):
Accepted TLSv1 256 bits AES256-SHA
Accepted TLSv1 256 bits CAMELLIA256-SHA
Accepted TLSv1 168 bits DES-CBC3-SHA
Accepted TLSv1 128 bits AES128-SHA
Accepted TLSv1 128 bits SEED-SHA
Accepted TLSv1 128 bits CAMELLIA128-SHA
Accepted TLSv1 128 bits RC4-SHA

If been trying to disable the RC4 (or allowing only AES256-SHA) without any success.

We need to pass the scan for PCI-DSS compliance.

M.D. Klapwijk

M.D. Klapwijk wroteWe ran into the same problem, Qualis/McAffee (PCI-DSS-ASV) external scan is reporting the availability of weak ciphers. We are using Openvpnas 2.0.10 and get the following when using sslscan:
Supported Server Cipher(s):
Accepted TLSv1 256 bits AES256-SHA
Accepted TLSv1 256 bits CAMELLIA256-SHA
Accepted TLSv1 168 bits DES-CBC3-SHA
Accepted TLSv1 128 bits AES128-SHA
Accepted TLSv1 128 bits SEED-SHA
Accepted TLSv1 128 bits CAMELLIA128-SHA
Accepted TLSv1 128 bits RC4-SHA

If been trying to disable the RC4 (or allowing only AES256-SHA) without any success.

We need to pass the scan for PCI-DSS compliance.

Sorry, someone forgot to mention that the weak ciphers were found on port 25 instead of 443. So openvpn-as is fine, but postfix was not ok. My bad...