Description of problem: My openconnect VPN connection stoped working after upgrade crypto-policies to 20200625-1.gitb298a9e version Before upgrade: # openconnect vpn.tensor.ru:501 --protocol=anyconnect POST https://vpn.tensor.ru:501/ Connected to 91.213.144.15:501 SSL negotiation with vpn.tensor.ru Connected to HTTPS on vpn.tensor.ru with ciphersuite (TLS1.2)-(DHE-CUSTOM1024)-(RSA-SHA512)-(AES-256-CBC)-(SHA1) XML POST enabled Please enter your username and password. GROUP: [Corp|Main|Region|TechSupport|TechSupport-Region]:Region POST https://vpn.tensor.ru:501/ XML POST enabled Please enter your username and password. Username:mv.gavrilov Password: POST https://vpn.tensor.ru:501/ Please enter your one-time password You will receive a password via mobile application or via SMS. SMS delivery time is up to 5 minutes. Be patient! Response: fgets (stdin): Interrupted system call Running transaction Preparing : 1/1 Upgrading : crypto-policies-scripts-20200625-1.gitb298a9e.fc33. 1/6 Upgrading : crypto-policies-20200625-1.gitb298a9e.fc33.noarch 2/6 Running scriptlet: crypto-policies-20200625-1.gitb298a9e.fc33.noarch 2/6 Upgrading : fips-mode-setup-20200625-1.gitb298a9e.fc33.noarch 3/6 Cleanup : fips-mode-setup-20200610-1.git7f9d474.fc33.noarch 4/6 Cleanup : crypto-policies-20200610-1.git7f9d474.fc33.noarch 5/6 Cleanup : crypto-policies-scripts-20200610-1.git7f9d474.fc33. 6/6 Running scriptlet: crypto-policies-scripts-20200625-1.gitb298a9e.fc33. 6/6 Running scriptlet: crypto-policies-scripts-20200610-1.git7f9d474.fc33. 6/6 Verifying : crypto-policies-20200625-1.gitb298a9e.fc33.noarch 1/6 Verifying : crypto-policies-20200610-1.git7f9d474.fc33.noarch 2/6 Verifying : crypto-policies-scripts-20200625-1.gitb298a9e.fc33. 3/6 Verifying : crypto-policies-scripts-20200610-1.git7f9d474.fc33. 4/6 Verifying : fips-mode-setup-20200625-1.gitb298a9e.fc33.noarch 5/6 Verifying : fips-mode-setup-20200610-1.git7f9d474.fc33.noarch 6/6 Completion plugin: Generating completion cache... After upgrade: # openconnect vpn.tensor.ru:501 --protocol=anyconnect POST https://vpn.tensor.ru:501/ Connected to 91.213.144.15:501 SSL negotiation with vpn.tensor.ru SSL connection failure: The Diffie-Hellman prime sent by the server is not acceptable (not long enough). Failed to open HTTPS connection to vpn.tensor.ru Failed to obtain WebVPN cookie Last good working version fo me: 20200610-1.git7f9d474
Proposed as a Blocker and Freeze Exception for 33-beta by Fedora user mikhail using the blocker tracking app because: Broken basic functionality. Due to this bug, I cant work remotely.
DHE-CUSTOM1024 - DiffieHellman 1024 is really just too weak. It was too weak in 1999. Anything that does DH1024 is able to do at least DH1536 or DH2048. Upgrade the server to accept stronger proposals
(In reply to Paul Wouters from comment #2) > DHE-CUSTOM1024 - DiffieHellman 1024 is really just too weak. It was too > weak in 1999. Anything that does DH1024 is able to do at least DH1536 or > DH2048. > > Upgrade the server to accept stronger proposals My organization use Cisco ASA 5510 and Cisco 5585-X. I am not network admin but I suppose these hardware solutions that don't support other ciphers.
Then please switch to LEGACY policy. It is there for exactly the situations like yours. update-crypto-policies --set LEGACY
(In reply to Tomas Mraz from comment #4) > Then please switch to LEGACY policy. It is there for exactly the situations > like yours. > > update-crypto-policies --set LEGACY Thanks, it helped. I appreciate stronger security settings, but as a user I happier when my OS solves my tasks out of the box. Today many Fedora users working remotely due to COVID-19 and they will very surprised when after upgrade to F33 they couldn't connect to their work. My proposal that the security policy should restrict only server software. Users who are not system administrators shouldn't fill bugreports and search for answers on the Internet to perform simple actions (I think the connection to employer VPN server should be maximum simple action). P.S. I asked my network admins why Cisco ASA used "DiffieHellman 1024". The answer was simple "This is default" So I suppose nowadays most organizations used also proprietary Cisco ASA with default settings.
Unfortunately without dropping support for weak ciphers, protocols and parameters from default configuration nobody without a clue would really move and we would probably still see RC4 or even DES with SSLv3 used almost everywhere. The legacy policy is there for a reason and the strong default is the way to go.