RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1367026 - Document and test procedure for running IdM Server in TLS 1.2+ environment
Summary: Document and test procedure for running IdM Server in TLS 1.2+ environment
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa
Version: 6.9
Hardware: Unspecified
OS: Unspecified
high
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Kaleem
Aneta Šteflová Petrová
URL:
Whiteboard:
Depends On: 1330758 1371315
Blocks: 1365846 1403694
TreeView+ depends on / blocked
 
Reported: 2016-08-15 09:50 UTC by Martin Kosek
Modified: 2017-03-21 11:47 UTC (History)
11 users (show)

Fixed In Version: ipa-3.0.0-51.el6
Doc Type: Enhancement
Doc Text:
IdM servers can now be configured to require *TLS* 1.2 or better Version 1.2 of the Transport Layer Security (TLS) protocol is considered significantly more secure than previous versions. This update enables you to configure your Identity Management (IdM) server to forbid communication using protocols that are less secure than *TLS* 1.2. For details, see the following Red Hat Knowledgebase article: https://access.redhat.com/articles/2801181.
Clone Of:
: 1403694 1426258 (view as bug list)
Environment:
Last Closed: 2017-03-21 11:47:52 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:0781 0 normal SHIPPED_LIVE ipa bug fix update 2017-03-21 12:49:18 UTC

Description Martin Kosek 2016-08-15 09:50:08 UTC 
Description of problem:
Prepare, document and test a procedure for configuring IdM Server (FreeIPA) by enabling only ciphers TLS 1.2 or stronger.

This procedure will ensure that:
- all primary IdM components (ipa-server, 389-ds-base+openldap, pki-core+tomcat, httpd+mod_nss, krb5-server, sssd) support TLS 1.2 and can be configured to only support that cipher suite or stronger.
- Administrator has a procedure to strengthen IdM cipher suite in case a vulnerability similar to POODLE (IdM Bug 1154687) emerges and allowed ciphers become vulnerable.
Comment 3 Tomas Krizek 2016-10-20 13:56:08 UTC 
The procedure depends on bug 1330758, because we need to disable TLS1.0 and TLS1.1.
Comment 4 Petr Vobornik 2016-10-20 14:05:50 UTC 
Which means that 389-ds-base dependency needs to be raised to: 389-ds-base-1.2.11.15-83.el6
Comment 14 Martin Kosek 2016-12-15 13:52:38 UTC 
Regarding release note, I would not recommend people to override default configuration as said below:

~~~
The TLS protocol version 1.2 is considered more secure than previous versions of TLS. Therefore, Red Hat recommends administrators to configure Identity Management (IdM) servers to use TLS 1.2.
~~~

I would only recommend doing in specific environments which have high security requirements and do not have any devices only working with lower TLS versions (which is the reason why the default is TLS 1.0+). What about something like:

~~~
IdM servers can now be configured to use TLS 1.2

The TLS protocol version 1.2 is considered more secure than previous versions of TLS. When IdM server is deployed in an environment with high security requirements, it can be now configured to only support communication using TLS 1.2 ciphers or stronger. IdM clients only supporting older TLS versions will not be able to communicate with IdM server after the change.

For details, see the following Red Hat Knowledgebase article: https://access.redhat.com/articles/2801181
~~~
Comment 15 Aneta Šteflová Petrová 2016-12-15 14:09:06 UTC 
Thanks a lot, Martin. All this information should also be stated in the KBase article. And because I wouldn't want to duplicate all of it, I added only the following to the Doc Text:

-----
The TLS protocol version 1.2 is considered more secure than previous versions of TLS. This update enables you to configure your IdM server to only support communication using TLS 1.2 ciphers or stronger.
-----

I added this to the article:

-----
TLS 1.2 is considered more secure than previous versions of TLS. If your IdM server is deployed in an environment with high security requirements, you can configure it to only support communication using TLS 1.2 ciphers or stronger. [introduction]

IdM clients that only support previous TLS versions are no longer able to communicate with the IdM server. [the "Result" section]
-----

Does this make sense? Would you change anything?
Comment 16 Martin Kosek 2016-12-15 14:30:49 UTC 
This is fine with me, thanks!
Comment 18 Donald Berry 2017-02-22 21:58:51 UTC 
Is there a similar BZ/doc for RHEL 7?  I searched BZ, did not see one.

Thanks.

Don
Comment 19 Tomas Krizek 2017-02-23 08:48:02 UTC 
Donald, you can follow the steps in the guide for RHEL 6. There should be only minor differences.

1. Use the systemctl command to start/stop/restart services instead of /sbin/service.
2. Skip the Configure the IdM Certificate Authority (CA) section, since there is no longer a separate DS service for the CA in RHEL 7. Please note you still have to follow the steps in Configure the Certificate Server (CS) Component.

I'm not aware of any official RHEL 7 document describing how to configure TLS1.2+.
Comment 20 Aneta Šteflová Petrová 2017-02-23 08:50:44 UTC 
(In reply to Tomas Krizek from comment #19)
> 
> I'm not aware of any official RHEL 7 document describing how to configure
> TLS1.2+.

There isn't any document for RHEL 7. Do we need one?
Comment 21 Tomas Krizek 2017-02-23 08:57:57 UTC 
(In reply to Aneta Šteflová Petrová from comment #20)
> There isn't any document for RHEL 7. Do we need one?

Since there are some differences in the configuration, I think we should have a guide for RHEL 7. From development perspective, it would be a minor effort - simply testing the steps mentioned above.
Comment 22 Martin Kosek 2017-02-23 14:34:48 UTC 
I agree it should be documented and tested in RHEL-7 also, I cloned toe but to Bug 1426258.
Comment 24 errata-xmlrpc 2017-03-21 11:47:52 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2017-0781.html
Note You need to log in before you can comment on or make changes to this bug.