How to remove vulnerable ciphers

[Sue]

Penetration tests are showing vulnerabilities on the port that arssockd listens on: 3DES-CBC SHA1.
I have added ARSSOCK_STRICT_SHA2_ONLY_CERTS=1 to ars.cfg file, cycled arssockd. vulnerability is still there.
I have a case opened with IBM. The support person claims that the ssl certificate is determining cipher used, which I believe is incorrect.  I believe the cipher is negotiated prior to certificate exchange, and cert is used for authentication, not cipher negotiation.

Any suggestions how I might correct this issue ?  Is there an equivalent parameter for 3DES to add to ars.cfg file ?

[Justin Derrick]

As far as GSKit is concerned, there is no (documented?) way to pre-select which specific, individual ciphers are used for communications, but you can disable the old version of TLS with GSK_PROTOCOL_TLSV1=0.  I suspect this needs to be exported as an environment variable before you start the CMOD arssockd daemon.

Since 3DES-CBC-SHA1 is not a public key algorithm, your security folks are more likely concerned with protecting communications, and are probably confused about how the certificate factors into this.

The parameter you've set in the CMOD ars.ini file simply prevents insecure certificates from being used, it doesn't factor into the selection of ciphers - See:  https://cmod.wiki/index.php?title=ars.ini#Unlisted_CMOD_Configuration_Parameters

Your best bet is to open a new ticket, asking how to configure the ciphers that GSKit presents to clients, or for other recommended flags to set as environment variables to modify GSKit's behaviour.

-JD.

[Ed_Arnold]

Sue - are you on z?

This is how we input those parms when we were doing testing, copied from a test ARSSOCKD:

XXARSSOC95 EXEC PGM=ARSSOCKD,REGION=0M,TIME=NOLIMIT, 
* PARM='ENVAR(GSK_PROTOCOL_TLSV1_2=ON,GSK_V3_CIPHER_SPECS=3C)  Pick one, can't both be active
* PARM='ENVAR(GSK_PROTOCOL_TLSV1_2=ON,GSK_PROTOCOL_TLSV1=0)    Pick one, can't both be active 
             /-S -I ARCH950 -v'          

Ed                 

[Sue]

Thank you for your reply. I am on multiplatform.  I have the following configured:
ARSSOCK_TLSV12_ONLY=1
ARSSOCK_STRICT_SHA2_ONLY_CERTS=1

Based on further testing over the weekend, I believe that I need to block the 3DES/TDES/TDEA cipher and am trying to determine if there is an additional parameter for this.  I am also awaiting a response from IBM.