4

We are about to go live with an Azure Website and, as a precaution, did a security scan on the IP address that has been allocated to us.

There were a number of low severity warnings listed which we're not too worried about, however the scan did flag that something appears to be listening on port 454 and 455, and supports TLS1.0.

RESULTS:
Available non CBC cipher            Server's choice              SSL version
RC4-SHA                             DES-CBC3-SHA                 TLSv1

Does anyone know what this is? I can't find it obviously listed anywhere. If it's not necessary, can I switch it off? And if it is necessary, can I set it to require a more secure protocol?

We're hosted in the "Australia East" datacentre, in case that's relevant.

UPDATE 1: I have deployed a C# MVC web app using .NET 4.5 and it currently includes 1 WebJob. I've bound 1 SHA256 SSL certificate using SNI SSL.

I have seen the "Set up deployment from source control" link on the dashboard, but haven't used it. We currently deploy using our on TeamCity instance via Web Deploy.

5
  • Can you let us know what you have deployed to the Website and if you have configured it for source control deployments.
    – Simon W
    Jan 6, 2015 at 22:57
  • I've added an update with this info - hopefully it's what you were after. Jan 6, 2015 at 23:24
  • 1
    These ports are used for internal communication in Azure Websites infrastructure. They are not site specific (so it does not matter what you deployed) and you cannot turn them off. It is safe to ignore them. Jan 6, 2015 at 23:26
  • Thanks Petr, much appreciated. You say that are used for internal communication, but evidently they are externally accessible because they were picked up by an external scan. Because our client has specifically requested this scan and expects us to address any issues, can we have a bit more info about what the service is, why it supports TLS1.0, and how we can assure them it's safe to ignore even though it's been flagged as a vulnerability. Jan 7, 2015 at 0:02
  • As I said before, these ports are used for internal communication in Azure Websites infrastructure and not something we disclose publicly. As for TLS 1.0 support with RC4 cipher there, we are not aware of any security vulnerability to that internal service at this moment, however we are actively working on upgrading our machines to make sure we allow only the newer protocols to be used – so all concerns will be addressed. Jan 7, 2015 at 19:34

1 Answer 1

2

As Petr addressed in the comments to the question, these ports are used for internal communication by the Azure Web Apps.

As an update to this question, the Azure team has removed the RC4 cipher from port 443, and expects to have the RC4 cipher removed from ports 454 and 455 around the end of September 2015. If this item is coming up on your PCI compliance reports, it looks like it will be resolved soon.

This thread contains the updates from the Azure team: https://social.msdn.microsoft.com/Forums/azure/en-US/66d1fd5f-4384-4568-bf96-8a0b57033c07/azure-websites-port-454-and-455-insecure-ssl?forum=windowsazurewebsitespreview

UPDATE: The Azure team confirmed that this change was deployed in October 2015. Users are now reporting that their PCI scans are passing and are now not showing ports 454 and 455 to have RC4 available.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.