Detections
Analytics

4.2 Ensure Weak Protocols are Disabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Servers can be configured to disable specific TLS/SSL protocol versions which may be vulnerable to exploitation and/or lack features which improve the level of security as provided by newer versions of the protocol.

The TLSv1.0 protocol is vulnerable to the BEAST attack when used in CBC mode (October 2011). Unfortunately, the TLSv1.0 uses CBC modes for all of the block mode ciphers, which only leaves the RC4 streaming cipher which is also weak and is not recommended. Therefore, it is recommended that the TLSv1.0 protocol be disabled. The TLSv1.1 protocol does not support Authenticated Encryption with Associated Data (AEAD) which is designed to simultaneously provide confidentiality, integrity, and authenticity.

The NIST SP 800-52r2 guidelines for TLS configuration require that TLS 1.2 is configured with FIPS-based cipher suites be supported by all government TLS servers and clients and requires support of TLS 1.3 by January 1, 2024. A September 2018 IETF draft also depreciates the usage of TLSv1.0 and TLSv1.1 as shown in the references.

Solution

For mongod ('Primary daemon process for the MongoDB system')

In the configuration file /etc/mongod.conf, set the disabledProtocols option to to include TLS1_0,TLS1_1 :

net:
 ssl:
 mode: requireSSL
 PEMKeyFile: /etc/ssl/mongodb.pem
 CAFile: /etc/ssl/caToValidateClientCertificates.pem
 disabledProtocols: TLS1_0,TLS1_1

And restart monogdb instance with

mongod --config /etc/mongod.conf

Or

mongod --sslDisabledProtocols `TLS1_0,TLS1_1

Impact:

If an attempt to connect using a disabled protocol is made the connection attempt will fail and may have unanticipated impact on clients attempting to establish the connection.

See Also

https://workbench.cisecurity.org/benchmarks/19909

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: Windows

Control ID: eba20742255c4c988d5351ca46c5a356fd8d52544d881956ed40fa724182c7db