This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC!
We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.
Hi all,
We have a customer that is asking about the ISE ODBC connection to MSSQL.
According to our documentation we only support SQL server authentication - but no technical details.
Reading through MS documentation - it should be encrypted.
But it seems that there is an old downgrade attack that forces auth to be done on plain text.
https://f0rki.at/microsoft-sql-server-downgrade-attack.html
So questions I need answer for are:
Are we using ENCRYPT_NOT_SUP pr default in ISE (aka unencrypted password exchange)?
Would we allow the downgrade attack or ?
Can we force ENCRYPT_REQ to make sure we encrypt all data - including password exchange?
Br
Tue Frei Noergaard
Solved! Go to Solution.
Thank you Surendra.
-Krishnan
Hi Surendra,
I am the guy that was asking Tue about this, and i have my customer the information you provided, thanks you for that. The Customer has some further questions into this, maybe you are able to answer them ?
---
According to the documentation and your statement, Cisco ISE is using the JDBC encrypt property set to true. That's good news, but without further information this raises a few concerns.
According to the JDBC documentation [1], using encrypt=true only enables encryption if the server specifies a certificate. This would signify that ISE does not *require* encryption but merely request it, and thus is still vulnerable to the aforementioned vulnerability. Are there any supplemental properties set to enforce encryption?
Both the encrypt property and the new authentication property since JDBC version 6 does not document whether or how it's possible to enforce and require authentication. Rather, it looks like both properties merely *request* encryption, still leaving Cisco ISE open to the attack.
Also, how is the server certificate verified, and what CA is used? This should be specified through trustServerCertificate, hostNameInCertificate and trustStore which are set to unknown values or defaults in ISE - and definitely not documented.
In summary:
* Is it possible to specify which CA certificates in the ISE Trust Store can be used for verifying the MSSQL server certificate?
* Is it possible to specify which SubjectName is permitted in the certificate, or is it set automatically based on another parameter?
* Is it possible to specify encryption is to be *required* and not merely *requested*?
Hi Surendra,
I got this from the consultant handling the customer. Can you help us again?
"
I am the guy that was asking Tue about this, and i have my customer the information you provided, thanks you for that. The Customer has some further questions into this, maybe you are able to answer them ?
---
According to the documentation and your statement, Cisco ISE is using the JDBC encrypt property set to true. That's good news, but without further information this raises a few concerns.
According to the JDBC documentation [1], using encrypt=true only enables encryption if the server specifies a certificate. This would signify that ISE does not *require* encryption but merely request it, and thus is still vulnerable to the aforementioned vulnerability. Are there any supplemental properties set to enforce encryption?
Both the encrypt property and the new authentication property since JDBC version 6 does not document whether or how it's possible to enforce and require authentication. Rather, it looks like both properties merely *request* encryption, still leaving Cisco ISE open to the attack.
Also, how is the server certificate verified, and what CA is used? This should be specified through trustServerCertificate, hostNameInCertificate and trustStore which are set to unknown values or defaults in ISE - and definitely not documented.
In summary:
* Is it possible to specify which CA certificates in the ISE Trust Store can be used for verifying the MSSQL server certificate?
* Is it possible to specify which SubjectName is permitted in the certificate, or is it set automatically based on another parameter?
* Is it possible to specify encryption is to be *required* and not merely *requested*?
"
Best regards
Tue
@Surendra wrote:
Answering your questions in order.
1. No, it is not possible to choose a specific CA certificate. ISE will validate aganist all the certs in the store.
2. Can you explain more ? Which certificate are we talking about ?
Since we can't decide what certs to trust on a per-certificate basis be only on a trusted CA basis, it would be nice if ISE only accepted the servers certificate if it contained a certain CN, or if the CN had to match the configured server fqdn in the ODBC configuration of ISE,
3. No. Currently ISE does not support enforcement of trust. There is an internal enhancement request open for this.
Great, is it possible to share that information with the local SE so we might track that enhancement request?
Understood, i will let my local SE figure out how to keep us informed.
please share enhancement bug id with me on internal email : tuenoerg@cisco.com
So, could you shed some light on question 2?
2. Can you explain more ? Which certificate are we talking about ?
This would be the SQL server certificate we need to validate as a SQL client in ISE. Does ISE accept *any* certificate CN/subject name as long as the cert is signed by an approved CA? Or does ISE check the certificate CN against eg. the ODBC connection server name entered in ISE?
ok, thanks for the reply