Search

Page tree

Contents

When you log in to the NIOS appliance, your computer ma kes an HTTPS (Hypertext Transfer Protocol over Secure Sockets Layer protocol) connection to the NIOS appliance. HTTPS is the secure version of HTTP, the client-server protocol used to send and receive communications throughout the Web. HTTPS uses SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security) protocols to secure the connection between a client and server. SSL/TLS provides server authentication and encryption. The NIOS appliance supports TLS versions 1.0, 1.1, and 1.2. TLS provides cipher suites that are used to negotiate the security settings for the secure connection. Infoblox has provided a few CLI commands so you can enable and disable specific cipher suites. For detailed information about these CLI commands, refer to the Infoblox CLI Guide.
Note that enabling or disabling the TLS ciphers will enable or disable the equivalent SSHd cipher. The following table lists the TLS suite name and the corresponding OpenSSL suite name, SSHd cipher name, and SSHd MAC name:

Table 1.1 TLS Cipher Suites

TLS Suite Name

Open SSL Suite Name

SSHd Cipher

SSHd MAC

TLS_DHE_RSA_WITH_AES_256_CBC_SHA

DHE-RSA-AES256-SHA

aes256-cbc

hmac-sha1,
hmac-sha1-etm@openssh.com

TLS_DHE_DSS_WITH_AES_256_CBC_SHA

DHE-DSS-AES256-SHA

aes256-cbc

hmac-sha1,
hmac-sha1-etm@openssh.com

TLS_RSA_WITH_AES_256_CBC_SHA

AES256-SHA

aes256-cbc

hmac-sha1,
hmac-sha1-etm@openssh.com

TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA

EDH-RSA-DES-CBC3-SHA

3des-cbc

hmac-sha1,
hmac-sha1-etm@openssh.com

TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA

EDH-DSS-DES-CBC3-SHA

3des-cbc

hmac-sha1,
hmac-sha1-etm@openssh.com

TLS_RSA_WITH_3DES_EDE_CBC_SHA

DES-CBC3-SHA

3des-cbc

hmac-sha1,
hmac-sha1-etm@openssh.com

TLS_DHE_DSS_WITH_AES_128_CBC_SHA

DHE-DSS-AES128-SHA

aes128-cbc

hmac-sha1,
hmac-sha1-etm@openssh.com

TLS_DHE_DSS_WITH_AES_128_CBC_SHADHE-DSS-AES128-SHAaes128-cbchmac-sha1, hmac-sha1-etm@openssh.com

TLS_RSA_WITH_AES_128_CBC_SHA

AES128-SHA

aes128-cbc

hmac-sha1,
hmac-sha1-etm@openssh.com

TLS_RSA_WITH_RC4_128_SHA

RC4-SHA

arcfour128

hmac-sha1,
hmac-sha1-etm@openssh.com

TLS_DHE_DSS_WITH_AES_256_GCM_SHA384DHE-DSS-AES256-GCM-SHA384aes256-gcm@openssh.comhmac-sha2-512,
hmac-sha2-512-etm@openssh.com

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

DHE-DSS-AES256-GCM-SHA384

aes256-gcm@openssh.com

hmac-sha2-512,
hmac-sha2-512-etm@openssh.com

TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

DHE-RSA-AES256-SHA256

aes256-cbc

hmac-sha2-256,
hmac-sha2-256-etm@openssh.com

TLS_DHE_DSS_WITH_AES_256_CBC_SHA256

DHE-DSS-AES256-SHA256

aes256-cbc

hmac-sha2-256,
hmac-sha2-256-etm@openssh.com

TLS_RSA_WITH_AES_256_GCM_SHA384

AES256-GCM-SHA384

aes256-gcm@openssh.com

hmac-sha2-512,
hmac-sha2-512-etm@openssh.com

TLS_DHE_DSS_WITH_AES_128_GCM_SHA256

DHE-DSS-AES128-GCM-SHA256

aes128-gcm@openssh.com

hmac-sha2-256,
hmac-sha2-256-etm@openssh.com

TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

DHE-RSA-AES128-GCM-SHA256

aes128-gcm@openssh.com

hmac-sha2-256,
hmac-sha2-256-etm@openssh.com

TLS_DHE_RSA_WITH_AES_128_CBC_SHA256

DHE-RSA-AES128-SHA256

aes128-cbc

hmac-sha2-256,
hmac-sha2-256-etm@openssh.com

TLS_DHE_DSS_WITH_AES_128_CBC_SHA256

DHE-DSS-AES128-SHA256

aes128-cbc

hmac-sha2-256,
hmac-sha2-256-etm@openssh.com

TLS_RSA_WITH_AES_128_GCM_SHA256AES128-GCM-SHA256aes128-gcm@openssh.comhmac-sha2-256, hmac-sha2-256-etm@openssh.com

TLS_RSA_WITH_AES_128_CBC_SHA256

AES128-SHA256

aes128-cbc

hmac-sha2-256,
hmac-sha2-256-etm@openssh.com


To avoid possible attacks in which HTTP or HTTPS connections are made to a web server and stay open much longer than they should be, Infoblox provides the set connection_limit and show connection_limit CLI commands that you can use to mitigate these attacks. In general, these attacks can result in the web server reaching its maximum number of concurrent connections, and thus denying connections from legitimate sources. You can use the CLI commands to limit the number of concurrent HTTP and HTTPS connections from a given client that corresponds to a particular IP address. For information about the CLI commands and how to use them, refer to the Infoblox CLI Guide.

This page has no comments.