Red Hat Bugzilla – Bug 1131049
Update SSL ciphers configured in 389-ds-base
Last modified: 2015-03-05 05:13:19 EST
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/4395 FreeIPA still configure the same (SSL and other) ciphers as in the beginning. Nessus and similar crypto detection tools mark some of the ciphers as low secure. '''Reports on port 389, 636''' Reported low secure SSL ciphers (< 56-bit key): {{{ TLSv1 EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2-CBC(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export }}} Reported null SSL cyphers: {{{ NULL-SHA Kx=RSA Au=RSA Enc=None Mac=SHA1 }}} Medium strength ciphers (>= 56-bit and < 112-bit key) {{{ TLSv1 EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES-CBC(56) Mac=SHA1 export EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export DES-CBC-SHA Kx=RSA Au=RSA Enc=DES-CBC(56) Mac=SHA1 }}} '''Reports on port 9443:''' Medium strength ciphers (>= 56-bit and < 112-bit key) {{{ SSLv3 DES-CBC-SHA Kx=RSA Au=RSA Enc=DES-CBC(56) Mac=SHA1 TLSv1 DES-CBC-SHA Kx=RSA Au=RSA Enc=DES-CBC(56) Mac=SHA1 }}} Additionally, there was a report that httpd has Track and Trace methods enabled. This could be disabled with `TraceEnable` directive.
Fixed upstream master: https://fedorahosted.org/freeipa/changeset/ab196220fdd886fc2b1998eeee0f8e9a4b384845 ipa-4-1: https://fedorahosted.org/freeipa/changeset/90e87310c6c8cb0bf88917afd0793a2a2ec1d5b6 ipa-4-0: https://fedorahosted.org/freeipa/changeset/93b9d029ce147eb6b4c4ad36ce3c75e5fad37214
Please add steps to verify
I can think of using nmap for listing the supported ciphers. With ipa-server-3.3.3-28.el7.x86_64 I get: # nmap --script ssl-enum-ciphers -p 636 `hostname` Starting Nmap 6.40 ( http://nmap.org ) at 2014-09-25 07:03 EDT Nmap scan report for vm-067.idm.lab.bos.redhat.com (10.16.78.67) Host is up (0.000091s latency). PORT STATE SERVICE 636/tcp open ldapssl | ssl-enum-ciphers: | TLSv1.0: | ciphers: | SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA - strong | SSL_RSA_FIPS_WITH_DES_CBC_SHA - weak | TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA - weak | TLS_RSA_EXPORT1024_WITH_RC4_56_SHA - weak | TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 - weak | TLS_RSA_EXPORT_WITH_RC4_40_MD5 - weak | TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong | TLS_RSA_WITH_AES_128_CBC_SHA - strong | TLS_RSA_WITH_AES_256_CBC_SHA - strong | TLS_RSA_WITH_DES_CBC_SHA - weak | TLS_RSA_WITH_NULL_SHA - broken | TLS_RSA_WITH_RC4_128_MD5 - strong | TLS_RSA_WITH_RC4_128_SHA - strong | compressors: | NULL |_ least strength: broken Nmap done: 1 IP address (1 host up) scanned in 1.12 seconds With ipa-server-4.0.3-1.el7.x86_64 I get: # nmap --script ssl-enum-ciphers -p 636 `hostname` Starting Nmap 6.40 ( http://nmap.org ) at 2014-09-24 19:06 EDT Nmap scan report for ipa.mkosek-rhel71.test (10.16.78.57) Host is up (0.000091s latency). PORT STATE SERVICE 636/tcp open ldapssl | ssl-enum-ciphers: | TLSv1.2: | ciphers: | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - strong | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - strong | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - strong | TLS_RSA_WITH_AES_128_CBC_SHA - strong | TLS_RSA_WITH_AES_128_CBC_SHA256 - strong | TLS_RSA_WITH_AES_128_GCM_SHA256 - strong | TLS_RSA_WITH_AES_256_CBC_SHA - strong | TLS_RSA_WITH_AES_256_CBC_SHA256 - strong | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong | TLS_RSA_WITH_SEED_CBC_SHA - strong | compressors: | NULL |_ least strength: strong Nmap done: 1 IP address (1 host up) scanned in 1.28 seconds Notice the difference in "least strentgh". Ludwig, do you know of any better mean to verify the cipher strength?
no, the use of nmap looks good to me, but I don't know where nmap gets its classification of the cipher strength from.
Verified. IPA Version: ============ [root@dhcp207-214 ~]# rpm -q ipa-server ipa-server-4.1.0-15.el7.x86_64 [root@dhcp207-214 ~]# [root@dhcp207-214 ~]# nmap --script ssl-enum-ciphers -p 636 `hostname` Starting Nmap 6.40 ( http://nmap.org ) at 2015-01-20 17:26 IST Nmap scan report for dhcp207-214.testrelm.test (10.65.207.214) Host is up (0.000053s latency). PORT STATE SERVICE 636/tcp open ldapssl | ssl-enum-ciphers: | TLSv1.2: | ciphers: | TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong | TLS_RSA_WITH_AES_128_CBC_SHA - strong | TLS_RSA_WITH_AES_128_CBC_SHA256 - strong | TLS_RSA_WITH_AES_128_GCM_SHA256 - strong | TLS_RSA_WITH_AES_256_CBC_SHA - strong | TLS_RSA_WITH_AES_256_CBC_SHA256 - strong | TLS_RSA_WITH_RC4_128_MD5 - strong | TLS_RSA_WITH_RC4_128_SHA - strong | compressors: | NULL |_ least strength: strong Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds [root@dhcp207-214 ~]#
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0442.html