How To Show a List of Ciphers Used in CA PAM

Products

• CA Privileged Access Manager - Cloakware Password Authority (PA)
• CA Privileged Access Manager (PAM)

Issue/Introduction

You may need to find out the list of all cipher suites being used by PAM so that you can install the required cipher suites on your target devices.

 

Environment

All supported builds of CA PAM

Cause

To list the supported/installed ciphers in CA PAM

Resolution

There is a way to find out the cipher suites being used by PAM server.

Install Wireshark with pccap.
Start Wireshark
Use filters as below, you can develop filters based on your environment. Below is only an example.

tcp port 443 and host <CA PAM IP>

Start a browser session to your server
From the captured traffic, look for “server hello”
Beneath that, you should see all the protocols and suites being used. Expand each to see the details.

Example output:

Frame 213: 235 bytes on wire (1880 bits), 235 bytes captured (1880 bits) on interface 0
Ethernet II, Src: Dell_fc:xx:xx (xx:xx:xx:xx:xx:xx), Dst:yy:yy:yy:yy:yy:yy (yy:yy:yy:yy:yy:yy)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx, Dst: yyy.yyy.yyy.yyy
Transmission Control Protocol, Src Port: 49879, Dst Port: 443, Seq: 1, Ack: 1, Len: 181
Secure Sockets Layer
TLSv1.2 Record Layer: Handshake Protocol: Client Hello
Content Type: Handshake (22)
Version: TLS 1.0 (0x0301)
Length: 176
Handshake Protocol: Client Hello
Handshake Type: Client Hello (1)
Length: 172
Version: TLS 1.2 (0x0303)
Random: 860e03f365191af493ab532b267ce4f83c9a235493af6ecb...
Session ID Length: 0
Cipher Suites Length: 36
Cipher Suites (18 suites)
Cipher Suite: Reserved (GREASE) (0x8a8a)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc14)
Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc13)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)
Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)
Compression Methods Length: 1
Compression Methods (1 method)
Extensions Length: 95
Extension: Reserved (GREASE) (len=0)
Extension: renegotiation_info (len=1)
Extension: extended_master_secret (len=0)
Extension: SessionTicket TLS (len=0)
Extension: signature_algorithms (len=18)
Extension: status_request (len=5)
Extension: signed_certificate_timestamp (len=0)
Extension: application_layer_protocol_negotiation (len=14)
Extension: ec_point_formats (len=2)
Extension: supported_groups (len=10)
Extension: Reserved (GREASE) (len=1)

Additional Information

The list of ciphers may different from version to version of CA PAM.