教你如何在windows server中关闭RC4和3DES

网络安全领域常常可见不可及，而漏洞扫描后的修复，则更是难上加难，对漏洞修复人员的技能要求很高。下面分享一例SSL RC4 Cipher Suites Supported (Bar Mitzvah) 漏洞修复的方法，该漏洞CVSS 3.0评分5.9分。

Nessus scan info：

Description

The remote host supports the use of RC4 in one or more cipher suites.

The RC4 cipher is flawed in its generation of a pseudo-random stream of bytes so that a wide variety of small biases are introduced into the stream, decreasing its randomness.

If plaintext is repeatedly encrypted (e.g., HTTP cookies), and an attacker is able to obtain many (i.e., tens of millions) ciphertexts, the attacker may be able to derive the plaintext.

Solution

Reconfigure the affected application, if possible, to avoid use of RC4 ciphers. Consider using TLS 1.2 with AES-GCM suites subject to browser and web server support.

方法实作参考：

1，在windows server中关闭RC4，注册表设定如下：

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
    "Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
    "Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
    "Enabled"=dword:00000000

实际操作范例如下：

2，在windows server中关闭3DES，注册表设定如下：

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168]
        "Enabled"=dword:00000000

实际操作范例如下：

希望以上可以帮助到你，安全路上不孤单，分享更多网络安全技能知识。

如果您认为以上对您有帮助，希望可以点击大拇指点赞，点击关注后续更新。您的支持，才是我们创作的动力。