In regards to SSL and TLS security, is it possible to run multiple versions of each protocol on a server? If so, i would assume you would have to tell the apps which protocol to use since there are multiple versions installed. If not, what options are there for a similar environment?
Example: Server 1 has TLS 1.0, 1.1, and 1.2 on it.
It is certainly possible. Backwards compatibility necessitates it, some clients may not be able to talk TLS1.2, some may only be capable of TLS1.0, etc. The TLS protocol suite handles version negotiation in the server and client hello messages, so once the client is configured to use, say, TLS 1.2 only, it should be able to negotiate that version with the server. TLS Implementations such as GNUTLS and OpenSSL, which are widely used as the SSL backbone of popular server software such as Nginx, support such configuration trivially:
http {
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
server {
listen 443 ssl;
server_name www.example.com;
keepalive_timeout 70;
ssl_certificate www.example.com.crt;
ssl_certificate_key www.example.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
Related
The protocol in question is the MRCP v2 protocol.
Problem overview:
The client sends MRCP/TLS requests, and the server can't understand these since it doesn't have the ability to perform a TLS handshake or encryption. I am hoping that HAProxy, or any other proxy (Nginx?) will decrypt these TLS packets, and send it to the server, to which the server can respond, and then HAProxy can encrypt and send it back to the client.
If possible, I also want a way to extend this to the SIP protocol. From what I understood of HAProxy, it can't do TLS termination for TCP (layer 4), only HTTP (layer 7). Is there any work around/alternative to this?
You are looking for NGINX and its ngx_stream_ssl_module. It allows you to encrypt arbitrary TCP traffic (doesn't have to be HTTP). No special installation is required. Just install NGINX and front it to your server instead of HAProxy or whatever TLS terminator. Configuration is straightforward:
stream {
...
server {
listen 12345 ssl;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
ssl_certificate /usr/local/nginx/conf/cert.pem;
ssl_certificate_key /usr/local/nginx/conf/cert.key;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
...
}
}
Client -> NGINX (stream TLS termination) -> whichever TCP protocol.
NGINX will only do TLS encryption without inspecting the underlying protocol.
I need to add one of these ciphers support to my nginx server with OpenSSL 1.1.1d running on Debian 9, so remote server could connect
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_MD5
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P521
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256
my current nginx SSL config looks like this
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_stapling on;
ssl_stapling_verify on;
When I've just adding one of the ciphers, listed above, to the end of ssl_ciphers directive, remote server cannot connect, due to incompatible ciphers
How I can enable and test it?
You can use the development tools of your browser (e.g. firefox) to analyze the Cipher-Suite settings of the current session:
Firefox Network in development mode
I have generate two SSL certificates, one is RSA certificate and the other one is ECC certificate, for my domain forum.example.com and have implemented it in Nginx by using the following configuration:
listen 443 ssl http2; listen [::]:443 ssl http2;
server_name forum.example.com;
access_log /var/log/nginx/forum.example.com.log;
ssl on;
ssl_certificate /path/forum.example.com/fullchain.cer;
ssl_certificate_key /path/forum.example.com/forum.example.key;
ssl_certificate /path/forum.example.com_ecc/fullchain.cer;
ssl_certificate_key /path/forum.example.com_ecc/forum.example.com.key;
ssl_dhparam /path/dhparams.pem;
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
http2_idle_timeout 5m;
# Rest of the configuration
The idea behind this is to use ECC certificate whenever possible, and in the case where a client doesn't support ECC certificates, RSA certificate will be used. However, on my machine sometimes I see RSA certificate being used and sometimes ECC certificate being used. My guess is some round-robin method is being used to determine which certificate to use.
Is there a way to prioritise ECC over RSA, and if the client doesn't support ECC, the server will use RSA certificate?
I am trying to connect my remote nginx server which is configured to use ssl.
I fired a command
$curl https://10.73.80.197:8080/
but after that i am getting error. Here is the whole log-
* Hostname was NOT found in DNS cache
* Trying 10.73.80.197...
* Connected to 10.73.80.197 (10.73.80.197) port 80 (#0)
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
* Closing connection 0
curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
as explained in several other articles:
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number
Curl returns "Unknown protocol"
this kind of curl error is often the result of using a web proxy over https instead of http
you should check your https_proxy env variable
if you have something like
https://myproxy.example.com:8080/
then you should change and set the following
https_proxy=http://myproxy.example.com:8080/
I encountered this today and in my case it was a misconfiguration in my nginx.conf file. My configuration contained something like this:
server {
listen 443;
listen [::]:443;
# Single underscore means 'matches any server name'
server_name _;
root /usr/share/nginx/html;
# Only allow more recent (still secure) versions of TLS
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
# Explicitly set list of supported ciphers
ssl_ciphers ECDH+AESGCM:ECDH+AES256-CBC:ECDH+AES128-CBC:DH+3DES:!ADH:!AECDH:!MD5;
ssl_certificate "/etc/pki/atmloader/server.crt";
ssl_certificate_key "/etc/pki/atmloader/server.pem";
# ...
}
but it should have looked like this:
server {
listen 443 ssl;
listen [::]:443 ssl;
# Single underscore means 'matches any server name'
server_name _;
root /usr/share/nginx/html;
# Only allow more recent (still secure) versions of TLS
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
# Explicitly set list of supported ciphers
ssl_ciphers ECDH+AESGCM:ECDH+AES256-CBC:ECDH+AES128-CBC:DH+3DES:!ADH:!AECDH:!MD5;
ssl_certificate "/etc/pki/atmloader/server.crt";
ssl_certificate_key "/etc/pki/atmloader/server.pem";
# ...
}
Notice the missing ssl in the listen parameter values.
A copy-and-paste mistake on my part when copying configuration that was originally created for a non-HTTPS port.
Why on my server still enabled SSLv3 ? I want to disable for reasons that in some computers can not open my page because of safety issues.
I found this guide:
But currently I've got it set. My server is hosted in Google Cloud, I currently have this Nginx configuration file:
...
ssl on;
ssl_certificate /etc/nginx/dba_certs/dba_ssl2/ssl-bundle.crt;
ssl_certificate_key /etc/nginx/dba_certs/dba_keys/dba.key;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;
...
OpenSSL version is 1.0.1f 6 Jan 2014.
What could be wrong?
To disable SSLv3, you'll have to edit default server configuration, not just an arbitrary virtual host config. It can only be disabled for a listen socket, not just a virtual server. The configuration snippet you've provided suggests that you are using per-server included configuration files, so you'll have to find one with default_server in the appropriate listen directive, and disable SSLv3 there:
server {
listen 443 default_server ssl;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
...
}
Or, better yet, edit the configuration at http level, in nginx.conf:
http {
...
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
...
}
You may also consider upgrading nginx to a recent version. In nginx 1.9.1+ SSLv3 is disabled by default.
I can confirm that SSL3 is enabled. To disable, you need to modify either the NGINX configuration (nginx.conf) or the VirtualHost configuration file. In your case it is probably the following file:
$ sudo vim /etc/nginx/sites-enabled/dragonboundaimbot.com
...
listen 443 default_server ssl;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
...
$ sudo service nginx restart
SSL3 is not the only problem though. Some of the cypher suites are depreciated and should not be used. Try to reduce the cypher-suites to the following:
TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) 256
TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256
TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c) 128
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 112
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) ECDH 256 bits (eq. 3072 bits RSA) FS 256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH 256 bits (eq. 3072 bits RSA) FS 256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH 256 bits (eq. 3072 bits RSA) FS 128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH 256 bits (eq. 3072 bits RSA) FS 128
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012) ECDH 256 bits (eq. 3072 bits RSA) FS 112
For other improvements, check e.g. the website with the Chrome browser and/or run an additional test on ssllabs.com.
I have created a gist for the steps to be followed to get a A rating in Qualys SSL test. And steps to disable SSLv3 and enable TSLv1 in proper way
Add SSL ciphers :
ssl_ciphers
'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
Fix OpenSSL Padding Oracle vulnerability :
https://gist.github.com/ArturT/bc8836d3bedff801dc324ac959050d12
ADD SSL protocols:
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
Set Preferred ciphers on:
ssl_prefer_server_ciphers on;
in the server block we should enable TCP v6 and v4 support
listen 443 ssl;
listen [::]:443 ssl;
add default_server in the above block
listen 443 default_server ssl;
listen [::]:443 default_server ssl;
Or Read here :
https://gist.github.com/kaushikgandhi/663e6e47d8a42025e848e454f5e064c4