AMQP Cleartext Authentication - vulnerability

[nordsgirl Gonzales]

Hi RMQ users, I implemented the solution to address the AMQP cleartext authentication vulnerability as recommended in this article.

https://www.tenable.com/plugins/index.php?view=single&id=87733

However, after implementing the solution, it is causing the following error message:  Any help is greatly appreciated.  Thank you in advance.

2018-05-23 08:24:27.5638 - RabbitMQ.Client.Exceptions.BrokerUnreachableException: None of the specified endpoints were reachable ---> RabbitMQ.Client.Exceptions.ConnectFailureException: Connection failed ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 172.16.0.86:5672

   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)

   at System.Net.Sockets.Socket.Connect(EndPoint remoteEP)

   at System.Net.Sockets.Socket.Connect(IPAddress address, Int32 port)

   at RabbitMQ.Client.TcpClientAdapter.<ConnectAsync>d__2.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()

   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

   at RabbitMQ.Client.Impl.TaskExtensions.<TimeoutAfter>d__1.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()

   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

   at RabbitMQ.Client.Impl.SocketFrameHandler.ConnectOrFail(ITcpClient socket, AmqpTcpEndpoint endpoint, Int32 timeout)

   --- End of inner exception stack trace ---

   at RabbitMQ.Client.EndpointResolverExtensions.SelectOne[T](IEndpointResolver resolver, Func`2 selector)

   at RabbitMQ.Client.Framing.Impl.AutorecoveringConnection.Init(IEndpointResolver endpoints)

   at RabbitMQ.Client.ConnectionFactory.CreateConnection(IEndpointResolver endpointResolver, String clientProvidedName)

   --- End of inner exception stack trace ---

   at RabbitMQ.Client.ConnectionFactory.CreateConnection(IEndpointResolver endpointResolver, String clientProvidedName)

   at CDM.Dashboard.Integration.AmqpConnectionFactory.CreateConnection(Uri uri) 

 RabbitMQ.Client.Exceptions.BrokerUnreachableException: None of the specified endpoints were reachable ---> RabbitMQ.Client.Exceptions.ConnectFailureException: Connection failed ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 172.16.0.86:5672

   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)

   at System.Net.Sockets.Socket.Connect(EndPoint remoteEP)

   at System.Net.Sockets.Socket.Connect(IPAddress address, Int32 port)

   at RabbitMQ.Client.TcpClientAdapter.<ConnectAsync>d__2.MoveNext()

[Michael Klishin]

"Machine actively refused it" is Windows speak for "no process listened on the target interface+port".

What you're after is using TLS [1][2] or even x509 certificates for authentication [3].

1. http://www.rabbitmq.com/ssl.html

2. http://www.rabbitmq.com/troubleshooting-ssl.html

3. https://github.com/rabbitmq/rabbitmq-auth-mechanism-ssl

--
You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-users+unsubscribe@googlegroups.com.
To post to this group, send email to rabbitmq-users@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

MK

Staff Software Engineer, Pivotal/RabbitMQ

[Michael Klishin]

https://www.rabbitmq.com/troubleshooting-networking.html is another relevant guide,

as well as server logs.

To post to this group, send email to rabbitm...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

MK

Staff Software Engineer, Pivotal/RabbitMQ