Bug 1367026
| Summary: | Document and test procedure for running IdM Server in TLS 1.2+ environment | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Martin Kosek <mkosek> | |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> | |
| Status: | CLOSED ERRATA | QA Contact: | Kaleem <ksiddiqu> | |
| Severity: | unspecified | Docs Contact: | Aneta Šteflová Petrová <apetrova> | |
| Priority: | high | |||
| Version: | 6.9 | CC: | apetrova, cheimes, dberry, enewland, mkosek, nsoman, pvoborni, rcritten, spoore, tkrizek, tscherf | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | ipa-3.0.0-51.el6 | Doc Type: | Enhancement | |
| Doc Text: |
IdM servers can now be configured to require *TLS* 1.2 or better
Version 1.2 of the Transport Layer Security (TLS) protocol is considered significantly more secure than previous versions. This update enables you to configure your Identity Management (IdM) server to forbid communication using protocols that are less secure than *TLS* 1.2.
For details, see the following Red Hat Knowledgebase article: https://access.redhat.com/articles/2801181.
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 1403694 1426258 (view as bug list) | Environment: | ||
| Last Closed: | 2017-03-21 11:47:52 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 1330758, 1371315 | |||
| Bug Blocks: | 1365846, 1403694 | |||
|
Description
Martin Kosek
2016-08-15 09:50:08 UTC
The procedure depends on bug 1330758, because we need to disable TLS1.0 and TLS1.1. Which means that 389-ds-base dependency needs to be raised to: 389-ds-base-1.2.11.15-83.el6 Regarding release note, I would not recommend people to override default configuration as said below: ~~~ The TLS protocol version 1.2 is considered more secure than previous versions of TLS. Therefore, Red Hat recommends administrators to configure Identity Management (IdM) servers to use TLS 1.2. ~~~ I would only recommend doing in specific environments which have high security requirements and do not have any devices only working with lower TLS versions (which is the reason why the default is TLS 1.0+). What about something like: ~~~ IdM servers can now be configured to use TLS 1.2 The TLS protocol version 1.2 is considered more secure than previous versions of TLS. When IdM server is deployed in an environment with high security requirements, it can be now configured to only support communication using TLS 1.2 ciphers or stronger. IdM clients only supporting older TLS versions will not be able to communicate with IdM server after the change. For details, see the following Red Hat Knowledgebase article: https://access.redhat.com/articles/2801181 ~~~ Thanks a lot, Martin. All this information should also be stated in the KBase article. And because I wouldn't want to duplicate all of it, I added only the following to the Doc Text: ----- The TLS protocol version 1.2 is considered more secure than previous versions of TLS. This update enables you to configure your IdM server to only support communication using TLS 1.2 ciphers or stronger. ----- I added this to the article: ----- TLS 1.2 is considered more secure than previous versions of TLS. If your IdM server is deployed in an environment with high security requirements, you can configure it to only support communication using TLS 1.2 ciphers or stronger. [introduction] IdM clients that only support previous TLS versions are no longer able to communicate with the IdM server. [the "Result" section] ----- Does this make sense? Would you change anything? This is fine with me, thanks! Is there a similar BZ/doc for RHEL 7? I searched BZ, did not see one. Thanks. Don Donald, you can follow the steps in the guide for RHEL 6. There should be only minor differences. 1. Use the systemctl command to start/stop/restart services instead of /sbin/service. 2. Skip the Configure the IdM Certificate Authority (CA) section, since there is no longer a separate DS service for the CA in RHEL 7. Please note you still have to follow the steps in Configure the Certificate Server (CS) Component. I'm not aware of any official RHEL 7 document describing how to configure TLS1.2+. (In reply to Tomas Krizek from comment #19) > > I'm not aware of any official RHEL 7 document describing how to configure > TLS1.2+. There isn't any document for RHEL 7. Do we need one? (In reply to Aneta Šteflová Petrová from comment #20) > There isn't any document for RHEL 7. Do we need one? Since there are some differences in the configuration, I think we should have a guide for RHEL 7. From development perspective, it would be a minor effort - simply testing the steps mentioned above. I agree it should be documented and tested in RHEL-7 also, I cloned toe but to Bug 1426258. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2017-0781.html |