如何处理补丁安装后IE浏览器无法访问eSight界面的问题

问题

安装eSight V300R010C00SPC630及之后的补丁或V300R010C00CP5030及之后的补丁后，IE浏览器无法打开网管界面，如何处理？

回答

该问题是由于补丁版本中删除了不安全的CBC加密算法，可通过如下操作增加对应的加密算法。

1. 以ossuser用户登录当前eSight服务器。

   高可用场景只需要在主服务器执行。

2. 修改配置文件“/opt/eSight/AppBase/3rdparty/nginx/conf/certificate.conf”，将配置项“ssl_ciphers”修改为：

   ssl_certificate      ../../../etc/certificate/application/outserver/outserver.crt;
   ssl_certificate_key  ../../../etc/certificate/application/outserver/outserver.pem;
   ssl_certificate_key_password  @6f0817ff0d58da93e2dfad85c4927d505767e51d04fae80a73479fd8f7eed263;
   ssl_client_certificate   ../../../etc/certificate/application/ca/ca.crt;
   ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA;
   ssl_prefer_server_ciphers on;
   ssl_protocols       TLSv1.2;
   ssl_ecdh_curve secp384r1;
   include ../../../etc/iemp.framework/nginx.winfo.conf;
   include ../../../etc/oms.core/nginx.rinfo.conf;

3. 修改配置文件“/opt/eSight/AppBase/etc/oms.sso/ext/esightsso.sso.ext.xml”，增加“param”配置，设置为：

   <?xml version="1.0" encoding="UTF-8" standalone="no"?>
   <sso-config>
   	<param name="webserverips">10.186.124.201</param>
   	<responseHeaders>
   		<header name="X-Frame-Options" value="SAMEORIGIN"/>
   		<header name="X-Content-Type-Options" value="nosniff"/>
   		<header name="X-Download-Options" value="noopen"/>
   		<header name="X-XSS-Protection" value="1; mode=block" />
   		<header name="Strict-Transport-Security" value="max-age=31536000; includeSubdomains" />
   	</responseHeaders>
    <param name="includeCipherSuites">TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</param>
   </sso-config>
   

4. 修改配置文件"/opt/eSight/mttools/etc/iemp.fw.roa.inst/roa.inst_ext_mttools.xml"，增加配置项“ssl.include.ciphers”，值设置为：

   <?xml version="1.0" encoding="UTF-8"?>
   <webservers>
       <webserver name="default">
           <responseHeaders>
               <header name="X-Content-Type-Options" value="nosniff"/>
               <header name="X-Download-Options" value="noopen"/>
               <header name="X-XSS-Protection" value="1; mode=block" />
               <header name="Strict-Transport-Security" value="max-age=31536000; includeSubdomains" />
           </responseHeaders>
           <connectors>
                         <connector name="httpsport" type="https">
                                   <property name="ssl.include.ciphers" value="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256;TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA;TLS_RSA_WITH_AES_256_CBC_SHA256;TLS_RSA_WITH_AES_256_CBC_SHA;TLS_RSA_WITH_AES_128_CBC_SHA256;TLS_RSA_WITH_AES_128_CBC_SHA" />
                           </connector>
                           <connector name="httpsIPV6sport" type="https"  allowedModel="ipall">
                                   <property name="ssl.include.ciphers" value="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256;TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA;TLS_RSA_WITH_AES_256_CBC_SHA256;TLS_RSA_WITH_AES_256_CBC_SHA;TLS_RSA_WITH_AES_128_CBC_SHA256;TLS_RSA_WITH_AES_128_CBC_SHA" />
                           </connector>
   </connectors>
       </webserver>
   </webservers>

5. 修改完成后需要重启eSight使配置文件生效。可以再次尝试登录网管界面。