the robot attack Vulnerability on Proxmox 5.2

[korealienzhu]

Hi Guys,
I have some Proxmox 5.2 hosts running in the lab. And Our IT security scanned the servers and reported robot attack Vulnerability on Proxmox 5.2.
details of vulnerability can be found here: robotattack.org/
so from the page, you can see the solution is to Disable RSA encryption, but I don't know how to disable it on proxmox since no httpd or apache or nginx running on proxmox.
anyone konws how to fix this vulnerability?

 

[Stoiko Ivanov]

You can configure the ciphersuite pveproxy uses, by editing `/etc/default/pveproxy`
and adding a line like:

CIPHERS='HIGH:!kRSA:!PSK:!aNULL:!MD5'

Which scanner did you/your security department use? (the reference script gave mixed results in our tests)

 

[korealienzhu]

You can configure the ciphersuite pveproxy uses, by editing `/etc/default/pveproxy`
and adding a line like:

CIPHERS='HIGH:!kRSA:!PSK:!aNULL:!MD5'

Which scanner did you/your security department use? (the reference script gave mixed results in our tests)

thanks for your quick response.
and It works.

the scanner we use is Qualys.

 

[korealienzhu]

You can configure the ciphersuite pveproxy uses, by editing `/etc/default/pveproxy`
and adding a line like:

CIPHERS='HIGH:!kRSA:!PSK:!aNULL:!MD5'

Which scanner did you/your security department use? (the reference script gave mixed results in our tests)

it looks like the way you said works only with Proxmox 5.0
if you want to fix it on Proxmox 5.2 and modify file /usr/share/perl5/PVE/Service/pveproxy.pm,
find line "cipher_list => $proxyconf->{CIPHERS} || 'HIGH:MEDIUM:!aNULL:!MD5',"
change this line to "cipher_list => $proxyconf->{CIPHERS} || 'HIGH:!kRSA:!PSK:!aNULL:!MD5',"
then run " pveproxy restart"

 

[Stoiko Ivanov]

That particular code did not change between 5.0 and 5.2 - so editing /etc/default/pveproxy really should work.
Also if you modify ` /usr/share/perl5/PVE/Service/pveproxy.pm` directly the changes will get overwritten with the next update.

 

[korealienzhu]

you are right.
but by default /etc/default/pveproxy is not there, you need to create file pveproxy
then add "CIPHERS='HIGH:!kRSA:!PSK:!aNULL:!MD5'" and pveproxy restart