Medium-strength cipher (3DES) findings in vulnerability scans

Vulnerability scanners sometimes report that a Media Server supports medium-strength SSL ciphers, such as 3DES. This article explains why the finding doesn't affect connections that use TLS 1.3, and how to remove weak ciphers if your Site needs TLS 1.2.

How the Media Server uses TLS

The Media Server uses TLS 1.3 for every connection where the other side supports it, including the Desktop Client, the Mobile Client, and current web browsers. TLS 1.3 doesn't include 3DES or any other medium-strength ciphers, so these connections can't use them.

A vulnerability scanner tests each TLS version separately, so it reports ciphers that are available over TLS 1.2 even when your clients never use them. The 3DES finding applies only to TLS 1.2.

If you need TLS 1.2, you can exclude weak ciphers from it.

Note: Check the port in the Plugin Output section of the scan report. The default Media Server port is 7001. If the finding is on a different port, it doesn't come from the Media Server. On Windows computers, the source is usually Windows itself, for example Remote Desktop on port 3389.

Before you begin

You need administrator access to the Media Server computer.
Each change requires a restart of the Media Server service, which stops recording for a short time. Desktop Clients reconnect automatically. Make the change during a maintenance window.
In a multi-Server Site, make the change on every Server that the scan reports.

Use TLS 1.2 and exclude weak ciphers

Although we don't recommend lowering your TLS settings, you could. If your Site needs TLS 1.2, you can change the allowedSslCiphers setting as well. This setting controls which cipher suites the Media Server accepts for TLS 1.2. The value HIGH:!RC4:!3DES allows only high-strength ciphers and excludes RC4 and 3DES.

For Windows

Open the registry editor and navigate to
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Digital Watchdog\Digital Watchdog Media Server
Add allowedSslVersions string, and set the desired value.
Add allowedSslCiphers string, and set the desired value.
Restart the Media Server to apply changes

For Linux

Open the mediaserver config file with any text editor:
/opt/digitalwatchdog/mediaserver/etc/mediaserver.conf
Add new line: allowedSslVersions=(desired value)
Add new line: allowedSslCiphers=(desired value)
Restart the server

Available values:

allowedSslVersions values: SSLv1, SSLv2, TLSv1, TLSv1.1, TLSv1.2, TLS.v1.3
allowedSslCiphers = HIGH:!RC4:!3DES

Note: If your security policy requires a stricter cipher list, you can set a different value in OpenSSL format. For the syntax, see the OpenSSL ciphers documentation. A stricter list can stop older applications from connecting.

Disable 3DES in Windows

If the finding is on a port other than the Media Server port, it comes from a Windows service, such as Remote Desktop. These services use the Windows TLS component, Schannel. Schannel settings apply to the whole computer. The Media Server doesn't use Schannel, so this change doesn't affect Media Server connections.

Caution: Disabling 3DES can stop very old clients and devices from connecting to Windows services on this computer. Check with your network administrator before you make the change.

For details, see the Microsoft documentation on TLS registry settings.

Note: In a domain, your network administrator can apply the same change to many computers through Group Policy.

Verify the change

Run the vulnerability scan again.
Confirm that the medium-strength cipher finding no longer appears for the port you changed.

To check a single port without a full scan, you can use Nmap from another computer. Replace <server_ip> with your values:

nmap --script ssl-enum-ciphers -p 7001 <server_ip>

The output must not list any cipher suites that contain 3DES.

Related to