Bug 1153739 - Disable SSL v3, by default.
Summary: Disable SSL v3, by default.
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: 389-ds-base
Version: 6.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Noriko Hosoi
QA Contact: Viktor Ashirov
URL:
Whiteboard:
Keywords:
Depends On:
Blocks: 1154687
TreeView+ depends on / blocked
 
Reported: 2014-10-16 16:51 UTC by Noriko Hosoi
Modified: 2019-07-11 08:16 UTC (History)
4 users (show)

(edit)
Cause: SSL version 3.0 has a known vulnerability. 

Fix: SSL version 3.0 is disabled, by default.
That is, to enable the version, the Directory Server has to be intentionally configured to use SSL version 3.0.

Result: The Directory Server is securer.
Clone Of:
(edit)
Last Closed: 2015-07-22 06:35:42 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:1326 normal SHIPPED_LIVE 389-ds-base bug fix and enhancement update 2015-07-20 17:53:07 UTC

Description Noriko Hosoi 2014-10-16 16:51:51 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/47928

On the new installation, SSL v3 should be disabled by default, and provide the safe cipher suites.

Comment 2 Noriko Hosoi 2015-02-19 23:23:52 UTC
Steps to verify.

Enable SSL with default cn=encryption,cn=config.
That is no "nsSSL3" nor "nsTLS1".

Check the error log and if the SSL version range does not include SSLv3 (e.g., as follows), the fix is verified.
SSL Initialization - SSL version range: min: TLS1.1, max: TLS1.2

You can use logconv.pl, as well.
https://bugzilla.redhat.com/show_bug.cgi?id=1153737#c7

Comment 3 Sankar Ramalingam 2015-03-24 14:51:14 UTC
By default SSLv3 is disabled. However, when I disable TLS1 and enable SSL3, it doesn't throw any error or warning messages.

[root@cloud-qe-15 ~]# ldapsearch -LLL -x -p 1389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=encryption,cn=config"
dn: cn=encryption,cn=config
nsSSL2: off
nsSSL3: off
nsTLS1: on

[root@cloud-qe-15 ~]# ldapmodify -x -p 1389 -h localhost -D "cn=Directory Manager" -w Secret123 << EOF
> dn: cn=encryption,cn=config
> replace: nsSSL3
> nsSSL3: on
> EOF
modifying entry "cn=encryption,cn=config"

[root@cloud-qe-15 ~]# ldapmodify -x -p 1389 -h localhost -D "cn=Directory Manager" -w Secret123 << EOF
dn: cn=encryption,cn=config
replace: nsTLS1
nsTLS1: off
EOF
modifying entry "cn=encryption,cn=config"

[root@cloud-qe-15 ~]# ldapsearch -LLL -x -p 1389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=encryption,cn=config"
dn: cn=encryption,cn=config
nsSSL2: off
nsSSL3: on
nsTLS1: off

Comment 4 errata-xmlrpc 2015-07-22 06:35:42 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1326.html


Note You need to log in before you can comment on or make changes to this bug.