Disabling medium strength ciphers in Gene6 FTP Server

I recently brought a client’s site into PCI Compliance as tested by SecurityMetrics. There was a non-obvious issue that required some detective work.

SecurityMetrics reported that the FTP server – Gene6 version 3 – supports a medium-strength cipher. Their diagnostic message stated:

The remote service supports the use of medium strength SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits and less than 112 bits.

It would have been nice if the report stated which medium strength ciphers the FTP server supports.

The Gene6 support forum offered no clues about what ciphers Gene6 supports or uses by default. I did find out that the GUI manager doesn’t offer a way to choose what ciphers the server uses, but there is a configuration file option. I can enter:

SSLCipherList=THIS-CIPHER:THAT-CIPHER

(Apparently SSL cipher names are always capitalized.)

The key came from a blog post about OpenSSL cipher strengths. You can use the OpenSSL command-line tool to initiate an SSL connection with a web service, like so:

openssl s_client -connect www.google.com:443 -cipher AES256-SHA

If the connection succeeds, then the service supports that cipher. Some ciphers have SSL2 and SSL3 variants. OpenSSL seems to default to the stronger variant. To test the SSL2 variant of a cipher, do this:

openssl s_client -connect www.google.com:443 -cipher RC4-MD5 -ssl2

I knew from another Gene6 forum post that Gene6 uses OpenSSL’s cipher names. You can get list of ciphers with this command:

openssl ciphers -v

Each line describes a cipher in shorthand, like this:

EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1

The number in parenthesis is the key length.

After running through the list of ciphers returned by the copy of OpenSSL on my workstation (0.9.08l), I found that Gene6 supports the following:

AES256-SHA
DES-CBC3-SHA
AES128-SHA
RC4-SHA
RC4-MD5 (SSL3 only)
DES-CBC-SHA

The last cipher on the list has a 56-bit key length, unacceptably short by modern standards. So, the line I needed to add to the Gene6 domain configuration file was:

SSLCipherList=AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA:RC4-MD5