MECM 2111 - port 10123

Question

Hi, can tcp port 10123 be disabled in site properties without causing some issues? I have vulnerability reported by Rapid7 saying self-signed certificate being used for communication on tcp port 10123 and I am struggling to remediate this.

If port should not be disabled any idea how to remediate this vulnerability? Thank you in advance.

Answer 1

You can't specifically disable it no, but if the port is not open, clients will fallback to 80 or 443 for client notification. This will cause an increased load on the MP(s) though.

I would seek an exception here though because in this case, although the cert is self-signed, it is created and controlled by ConfigMgr and not just a randomly generated cert.

Answer 2

If InfoSec reject my request how can I replace that certificate with one issued by CA?

Answer 3

You cannot. As noted, the most you can do is allow the port to be blocked and the clients will fallback to 80 or 443.

Answer 4

What about unchecking port 10123 in site properties (client communication)? That would block it?

Answer 5

I've honestly never thought about doing that and don't know the full ramifications of doing so. You can certainly try though and validate that client notification is still working. The client notification logs will show you the ports being used.