Disabling Outdated Elliptical Curves in Aria Automation for Enhanced Security Compliance

Products

• VMware Aria Suite

Issue/Introduction

During a penetration test as part of an audit for the Aria Automation environment, it was identified that outdated elliptical curves (secp521r1 and X25519) are being used on port 443. This does not comply with the information security requirement CRYPTO.A29 "Recommended elliptic curves".

Environment

VMware Aria Automation 8.x

Cause

The use of non-approved elliptic curves (secp521r1 and X25519) was identified on port 443 during a penetration test, indicating a potential security risk and non-compliance with current security standards and recommendations.

Resolution

To ensure the system meets current security standards and recommendations, follow these steps to disable the outdated elliptical curves:

Perform the following on all nodes (in case of HA):

Edit the Ingress Controller Configuration:
Locate and edit the file /opt/charts/ingress-ctl/values.yaml on each node.
Remove the cipher suite TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 that was flagged by the security scan.

Deploy the Changes:
On one of the nodes, execute the deploy script to apply the changes. Note that this operation requires downtime:

/opt/scripts/deploy.sh