{"action":"created","issue":{"url":"https://api.github.com/repos/Microsoft/OMS-Agent-for-Linux/issues/102","repository_url":"https://api.github.com/repos/Microsoft/OMS-Agent-for-Linux","labels_url":"https://api.github.com/repos/Microsoft/OMS-Agent-for-Linux/issues/102/labels{/name}","comments_url":"https://api.github.com/repos/Microsoft/OMS-Agent-for-Linux/issues/102/comments","events_url":"https://api.github.com/repos/Microsoft/OMS-Agent-for-Linux/issues/102/events","html_url":"https://github.com/Microsoft/OMS-Agent-for-Linux/issues/102","id":159387431,"number":102,"title":"Disable weak SSL ","user":{"login":"rubeon","id":687066,"avatar_url":"https://avatars.githubusercontent.com/u/687066?v=3","gravatar_id":"","url":"https://api.github.com/users/rubeon","html_url":"https://github.com/rubeon","followers_url":"https://api.github.com/users/rubeon/followers","following_url":"https://api.github.com/users/rubeon/following{/other_user}","gists_url":"https://api.github.com/users/rubeon/gists{/gist_id}","starred_url":"https://api.github.com/users/rubeon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rubeon/subscriptions","organizations_url":"https://api.github.com/users/rubeon/orgs","repos_url":"https://api.github.com/users/rubeon/repos","events_url":"https://api.github.com/users/rubeon/events{/privacy}","received_events_url":"https://api.github.com/users/rubeon/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-06-09T11:38:38Z","updated_at":"2016-06-17T14:33:54Z","closed_at":null,"body":"Hi, guys\r\n\r\nCan the SSL configuration for OMS's network traffic be hardened without negatively affecting Azure's infrastructure communications?  At the moment, it sets off vulnerability scanners with the following:\r\n\r\nNegotiated with the following insecure cipher suites: SSL 3.0 ciphers: TLS_RSA_WITH_IDEA_CBC_SHATLS 1.0 ciphers: TLS_RSA_WITH_IDEA_CBC_SHATLS 1.1 ciphers: TLS_RSA_WITH_IDEA_CBC_SHATLS 1.2 ciphers: TLS_RSA_WITH_IDEA_CBC_SHA\r\n\r\nNegotiated with the following insecure cipher suites: SSL 3.0 ciphers: TLS_RSA_WITH_RC4_128_MD5TLS_RSA_WITH_RC4_128_SHATLS 1.0 ciphers: TLS_RSA_WITH_RC4_128_MD5TLS_RSA_WITH_RC4_128_SHA TLS 1.1 ciphers: TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHATLS 1.2 ciphers: TLS_RSA_WITH_RC4_128_MD5TLS_RSA_WITH_RC4_128_SHA\r\n\r\nWould bit be possible to follow better security practices and disable weak ciphers?\r\n\r\n* disable SSL v3\r\n* disable DES and IDEA\r\n* disable support for RC4 ciphers.\r\n* Use only TLSv1.1+, as recommended by PCI-DSS?\r\n"},"comment":{"url":"https://api.github.com/repos/Microsoft/OMS-Agent-for-Linux/issues/comments/226785329","html_url":"https://github.com/Microsoft/OMS-Agent-for-Linux/issues/102#issuecomment-226785329","issue_url":"https://api.github.com/repos/Microsoft/OMS-Agent-for-Linux/issues/102","id":226785329,"user":{"login":"jeffaco","id":13700943,"avatar_url":"https://avatars.githubusercontent.com/u/13700943?v=3","gravatar_id":"","url":"https://api.github.com/users/jeffaco","html_url":"https://github.com/jeffaco","followers_url":"https://api.github.com/users/jeffaco/followers","following_url":"https://api.github.com/users/jeffaco/following{/other_user}","gists_url":"https://api.github.com/users/jeffaco/gists{/gist_id}","starred_url":"https://api.github.com/users/jeffaco/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeffaco/subscriptions","organizations_url":"https://api.github.com/users/jeffaco/orgs","repos_url":"https://api.github.com/users/jeffaco/repos","events_url":"https://api.github.com/users/jeffaco/events{/privacy}","received_events_url":"https://api.github.com/users/jeffaco/received_events","type":"User","site_admin":false},"created_at":"2016-06-17T14:33:54Z","updated_at":"2016-06-17T14:33:54Z","body":"@rubeon That's very strange. I would not expect port 1270 to be exposed unless the *Operations Manager* client was previously installed on this machine.\r\n\r\nIf you edit file `/etc/opt/omi/conf/omiserver.conf` and change `HTTPSPORT` to 0, then the OMS agent will no longer listen on port 1270. You don't need OMI to be listening for external connections to collect data on the local system. Unless you're using the *Operations Manager* client on the same system, you should not need to have port 1270 exposed."}}
{"actor":{"display_login":"jeffaco"}}