IT Security: SSL Ports, Ciphers, Protocols and Certificates

dreamstime_s_79973735 digital key img

Dear JDisc Friends,

With the upcoming Build 5136, we have implemented a new feature in the Security and Dependency Mapping Add-on. As you may know, the Dependency Add-On detects the list of open TCP/IP and UDP ports. A customer asked us if we could obtain information about the SSL certificates and encryption algorithms for each listening TCP/IP port. This would be useful information regarding application security and expiring certificates. We recently implemented a similar feature for SSH connections, where we collect the SSH encryption algorithms offered by SSH servers and the SSH algorithms used when establishing a connection.

To check whether a port uses SSL and, if so, which certificates and algorithms are used, we need to open a connection to that port and attempt to initiate the SSL handshake. If the handshake is successful, we also receive the list of certificates and the algorithms used. That didn’t sound too complicated. So I started implementing the function, tested it on one of my Linux servers, and finally got all the information I needed. Great!

Be very careful when using this function. We’re opening TCP/IP ports to test an SSL handshake. This could trigger intrusion detection systems. So always consult your security department before enabling this function!

Then I started scanning my network, and at some point my printer started printing junk pages! I was very surprised and checked the printer again. Same result. It started printing! Hmm. Okay, so I did some more research and found out that Port 9100 was the culprit! Port 9100 is used on many printers for a service called “raw printing.” If it isn’t properly secured (which is almost never the case), it starts printing when you send bytes to that port. The SSL handshake communication caused this problem because the handshake began with the transmission of an SSL ClientHello packet. The printer then began printing the incoming bytes. There’s also a great article explaining port 9100. You can find more details at http://hacking-printers.net/wiki/index.php/Port_9100_printing. Finally, we ignore ports 9100–9107 when searching for an SSL port.

This isn’t really funny. Due to potential side effects resulting from poorly written applications with little or no error handling, we do not enable this feature by default. However, you can enable this feature if you’re fairly certain that the applications on your network have adequate error handling. Use the detection configuration to enable this feature.

If you enable this feature, a warning dialog will appear explaining what will happen, and you can confirm whether you want to use this feature. We have tested this feature in our environment with many different operating systems and devices, and apart from the known printer connections, we have not encountered any problems.

However, if you enable this feature, you’ll receive additional useful information:

in addition to the certificates stored in a computer’s local certificate store
if the Security Add-On is installed in addition to the Dependency Mapping Add-On, you’ll receive the SSL cipher and the SSL protocol (TLS version).

Enable this feature in our Discovery Configuration dialog.

Figure: Activate the SSL Configuration Collection

Once the scan is complete, you can review the information for a specific device in the Device Details dialog box. Check the Open Ports tab to review SSL-related information. Note that you will only see this information if the Security Add-On is installed in addition to the Dependency Mapping Add-On.

Figure: SSL Ciphers and Protocols

The image above shows that some processes are still using TLSv1, which is no longer considered secure.

There are also summary reports in the Software > Security > SSL menu that list the SSL ciphers and protocols in use, as well as the number of devices using these algorithms. The SSL Cipher summary report (Software > Security > SSL) lists all SSL ciphers used by devices on the network, as well as the number of devices that actually use each cipher.