How to configure AES ciphers for the RSA Authentication Manager 8.1 Security Console

[#1]

Article Number

000028965

Applies To

RSA Product Set:  SecurID
RSA Product/Service Type:  Authentication Manager
RSA Version/Condition:  8.1

Issue

Access to the Authentication Manager 8.1 Security Console was lost after disabling the RC4 ciphers in client browsers or computers.

 

Task

To resolve this issue, following tasks must be performed:

1. Access the Authentication Manager server via command line.
2. Modify the config.xml file.
3. Restart the Authentication Manager services.

Resolution

Here’s a way to disable the RC4 cipher in a browser so that when connecting to the Authentication Manager Security Console, it does not negotiate using RC4 ciphers.  There is also something to be done on the Authentication Manager  server side to support non-RC4 Ciphers.  Here’s the outline.
 
Browsers can be configured to use non-RC4 ciphers.  These connections from the client workstation to the Authentication Manager consoles can be established via TLS and AES ciphers.  These connections from the client workstation to the Authentication Manager consoles can be established via TLS and AES ciphers. 

Some argue that the most secured mode possible is TLS 1.2 using RC4-128-SHA1, however once the RC4 ciphers are disabled, the connection will fail unless you enable another cipher for the Authentication Manager console in the config.xml file, such as AES.

Steps on how to disable RC4 ciphers on browsers are below.

Microsoft Internet Explorer 11

On the PC running the browser, open regedit and do the following:

1. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]"Enabled"=dword:00000000
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]"Enabled"=dword:00000000
3. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]"Enabled"=dword:00000000

Mozilla Firefox 33

On the PC running the browser, launch Firefox and do the following:

1. In the address bar, type about:config and press Enter.
2. Set the value for security.ssl3.ecdh_ecdsa_rc4_128_sha to false.
3. Set the value for security.ssl3.ecdh_rsa_rc4_128_sha to false.
4. Set the value for security.ssl3.ecdhe_ecdsa_rc4_128_sha to false.
5. Set the value for security.ssl3.ecdhe_rsa_rc4_128_sha to false.
6. Set the value for security.ssl3.rsa_rc4_128_md5 to false.
7. Set the value for security.ssl3.rsa_rc4_128_sha to false.

Note:  If you disable all RC4 ciphers, you will have to copy the ciphers from the biztier and add them to console 7004 port in the config.xml.  To do this,

1. SSH to the Authentication Manager 8.1 primary.
2. Navigate to /opt/rsa/am/server/config.
3. Run the following command:

cat config.xml | grep AES

4. The section of the file regarding AES cipher suites will display as below:

Image description

5. Highlight the following lines and paste them into a text editor.

Image description

Image description

 

6. Make a backup of the config.xml then edit the working copy.  Find the <listen-port> of 7004.  The RC4 cipher suite should be right above it.

Image description

 

7. Paste in the cipher suites copied above as in the sample below:

Image description
 

Image description

8. Use the command :wq! to save or :q! to quit without saving.
9. Navigate to /opt/rsa/am/server and run the following command to restart the Authentication Manager services.

./rsaserv restart all

10. After the services are completely started, access the Security Console.  
11. Check your connection using browser tools.