Disabling SSLv3 for GoAnywhere Director Administrator
Posted: Fri Oct 17, 2014 3:37 pm
Perform the following steps to disable SSLv3 support for the administrative interface of GoAnywhere Director. This process will mitigate the the exploit known as POODLE (or Padding Oracle On Downgraded Legacy Encryption) for HTTPS connections to the GoAnywhere Director administrator:
- Log in to the system where GoAnywhere Director is installed.
- Navigate to [INSTALL_DIR]/tomcat/conf where [INSTALL_DIR] is the installation directory of GoAnywhere Director.
- Edit the file server.xml
- Locate the <Connector /> element that is configured to support SSL.
- Add the attribute sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" to the <Connector /> element like the following screenshot:
- Save the file and restart the GoAnywhere Director service/subsystem.