Remove SSL Cipher 3DES for Auto Deploy on Port 6501 and 6502

Products

• VMware vCenter Server

Issue/Introduction

Ports 6501 and 6502 are used by the Auto Deploy service within vCenter; both ports are required to be opened.


When using Tenable or other 3rd party vulnerability scanner, results may include a warning on ports 6501 and 6502.

Environment

VMware vCenter Server

Resolution

At this time, VMware does not consider these as vulnerabilities.

Workaround:
To remove the Triple Data Encryption Algorithm (Triple DES) also known as 3DES cipher for the Auto Deploy service, perform the below workaround steps.

Note: Before making any changes on the vCenter, take powered off snapshots of all vCenters in the ELM environment.

1. SSH into the affected vCenter
2. Back up the following file

cp /etc/vmware-rbd/httpd/conf.d/vhosts-common-opts ~/vhosts-common-opts_BACKUP

3. Edit the vhosts-common-opts file

vi /etc/vmware-rbd/httpd/conf.d/vhosts-common-opts

4. Add :!3DES to the end of the following line:

SSLCipherSuite ${SSL_CIPHER_SUITE}

Example: the line should look like below.
SSLCipherSuite ${SSL_CIPHER_SUITE}:!3DES

5. Save the file

:wq!

6. If the Auto Deploy service is running, restart the Auto Deploy service.

service-control --restart vmware-rbd-watchdog

7. Perform a vulnerability scan and confirm the 3DES cipher is no longer present.

Additional Information

To discover what ports are needed by VMware products and solutions, use VMware Ports and Protocol - https://ports.esp.vmware.com/