Description of problem:
Prepare, document and test a procedure for configuring IdM Server (FreeIPA) by enabling only ciphers TLS 1.2 or stronger.
This procedure will ensure that:
- all primary IdM components (ipa-server, 389-ds-base+openldap, pki-core+tomcat, httpd+mod_nss, krb5-server, sssd) support TLS 1.2 and can be configured to only support that cipher suite or stronger.
- Administrator has a procedure to strengthen IdM cipher suite in case a vulnerability similar to POODLE (IdM Bug 1154687) emerges and allowed ciphers become vulnerable.
The procedure depends on bug 1330758, because we need to disable TLS1.0 and TLS1.1.
Which means that 389-ds-base dependency needs to be raised to: 389-ds-base-22.214.171.124-83.el6
Regarding release note, I would not recommend people to override default configuration as said below:
The TLS protocol version 1.2 is considered more secure than previous versions of TLS. Therefore, Red Hat recommends administrators to configure Identity Management (IdM) servers to use TLS 1.2.
I would only recommend doing in specific environments which have high security requirements and do not have any devices only working with lower TLS versions (which is the reason why the default is TLS 1.0+). What about something like:
IdM servers can now be configured to use TLS 1.2
The TLS protocol version 1.2 is considered more secure than previous versions of TLS. When IdM server is deployed in an environment with high security requirements, it can be now configured to only support communication using TLS 1.2 ciphers or stronger. IdM clients only supporting older TLS versions will not be able to communicate with IdM server after the change.
For details, see the following Red Hat Knowledgebase article: https://access.redhat.com/articles/2801181
Thanks a lot, Martin. All this information should also be stated in the KBase article. And because I wouldn't want to duplicate all of it, I added only the following to the Doc Text:
The TLS protocol version 1.2 is considered more secure than previous versions of TLS. This update enables you to configure your IdM server to only support communication using TLS 1.2 ciphers or stronger.
I added this to the article:
TLS 1.2 is considered more secure than previous versions of TLS. If your IdM server is deployed in an environment with high security requirements, you can configure it to only support communication using TLS 1.2 ciphers or stronger. [introduction]
IdM clients that only support previous TLS versions are no longer able to communicate with the IdM server. [the "Result" section]
Does this make sense? Would you change anything?
This is fine with me, thanks!
Is there a similar BZ/doc for RHEL 7? I searched BZ, did not see one.
Donald, you can follow the steps in the guide for RHEL 6. There should be only minor differences.
1. Use the systemctl command to start/stop/restart services instead of /sbin/service.
2. Skip the Configure the IdM Certificate Authority (CA) section, since there is no longer a separate DS service for the CA in RHEL 7. Please note you still have to follow the steps in Configure the Certificate Server (CS) Component.
I'm not aware of any official RHEL 7 document describing how to configure TLS1.2+.
(In reply to Tomas Krizek from comment #19)
> I'm not aware of any official RHEL 7 document describing how to configure
There isn't any document for RHEL 7. Do we need one?
(In reply to Aneta Šteflová Petrová from comment #20)
> There isn't any document for RHEL 7. Do we need one?
Since there are some differences in the configuration, I think we should have a guide for RHEL 7. From development perspective, it would be a minor effort - simply testing the steps mentioned above.
I agree it should be documented and tested in RHEL-7 also, I cloned toe but to Bug 1426258.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.