TRYING TO RESOLVE "AMQP Cleartext Authentication" Vulnerbilty

[RG00334999]

we tried couple of solutions to fix vulnerbilitity - AMQP Cleartext Authentication while following documentation available on Stackstorm forum but still not be able to fix the vul....

please help..

Note - Stackstorm is installed on Linux machines.

[arm4b]

The SSL auth configuration is available for RabbitMQ.

Provide more information so community can help you.
What exactly you're trying to do, what did you configure already, which settings exactly did you try to change and what didn't work (errors you're getting)?

[RG00334999]

tried below but no luck-

Login method to use (AMQPLAIN, PLAIN, EXTERNAL, etc.).
login_method = None

Use SSL / TLS to connect to the messaging server. Same as appending "?ssl=true" at the end of the connection URL string.

ssl = False

ca_certs file contains a set of concatenated CA certificates, which are used to validate certificates passed from RabbitMQ.

ssl_ca_certs = None

Specifies whether a certificate is required from the other side of the connection, and whether it will be validated if provided.

Valid values: none, optional, required

ssl_cert_reqs = None

Certificate file used to identify the local connection (client).

ssl_certfile = None

Private keyfile used to identify the local connection against RabbitMQ.

ssl_keyfile = None

URL of the messaging server.

url = amqp://guest:guest@127.0.0.1:5672//

[RG00334999]

Login method to use (AMQPLAIN, PLAIN, EXTERNAL, etc.).

login_method = None

Use SSL / TLS to connect to the messaging server. Same as appending "?ssl=true" at the end of the connection URL string.

ssl = False

ca_certs file contains a set of concatenated CA certificates, which are used to validate certificates passed from RabbitMQ.

ssl_ca_certs = None

Specifies whether a certificate is required from the other side of the connection, and whether it will be validated if provided.

Valid values: none, optional, required

ssl_cert_reqs = None

Certificate file used to identify the local connection (client).

ssl_certfile = None

Private keyfile used to identify the local connection against RabbitMQ.

ssl_keyfile = None

URL of the messaging server.

url = amqp://guest:guest@127.0.0.1:5672//

[arm4b]

Check the official RabbitMQ SSL guide:

• https://www.rabbitmq.com/ssl.html
• https://www.rabbitmq.com/troubleshooting-ssl.html
  There is also https://medium.com/dlt-labs-publication/how-to-set-up-an-ssl-tls-enabled-rabbitmq-server-3e4e47315e8b guiding how to generate and configure the certificates for RabbitMQ and then you can set respective SSL rabbitmq parameters in st2.conf

[RG00334999]

solutions are not worked in our environment

[nzlosh]

If the community is unable to provide the level of support you require to set up TLS, RabbitMQ or other 3rd party dependencies, you might want to consider contacting a partner for in-depth assistance.

[RG00334999]

is the partner portal is something funding project?

[nzlosh]

They are service providers that offer professional services for StackStorm.

[aparnka]

how to avoid AMQP clear text vulnarability without implementing ssl at server level