Configure operator console to use stronger cipher suite

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

Guide how to configure operator console to use higher cipher suite supported with TLS 1.2

Environment

Release : 20.3.x

Component : UIM - SECURITY VULNERABILITIES

Resolution

Should start with the <setup> section at the top of the wasp config. 

Within this section is an https_ciphers= key which has a very long string of cipher keys as the value. 
For now  should not make any changes here. 

Lower down inside the section is a subsection that just looks like this which begins 

<http_connector>
        compression = on
        compressionMinSize = 2048
        compressableMimeType = text/html,text/xml,text/plain,text/css,text/javascript,application/javascript,application/json,application/xml
        URIEncoding = UTF-8
</http_connector>

To this section we should add only the "sslEnabledProtocols" 
so that you end up with this:

<http_connector>
        compression = on
        compressionMinSize = 2048
        compressableMimeType = text/html,text/xml,text/plain,text/css,text/javascript,application/javascript,application/json,application/xml
        URIEncoding = UTF-8
        sslEnabledProtocols = TLSv1.2
    </http_connector>

With this configuration the ciphers in the https_ciphers list will only be allowed if they are also compliant with TLS 1.2,

So this should be sufficient and it should not be necessary to add the additional "ciphers" key

Note: Please take backup of existing OC wasp.cfg before any changes 

Additional Information

KB:UIM - How to disable weak SSL or TLS protocol and weak ciphers in UMP