Pārlūkot izejas kodu

Allow only TLSv1.2 ciphers when SSL is enabled (#2872)

Allow only TLSv1.2 ciphers when SSL is enabled

The commit is to remove the default support for the old
versions with known vulnerabilities (all SSL, TLSv1.0
and TLSv1.1)
We have kept support for only TLSv1.2.
We will need to add more ciphers to add support for
TLSv1.3 in future.

Co-authored-by: Amit Srivastava <asrivastava@cloudera.com>
Amit S 3 gadi atpakaļ
vecāks
revīzija
7b0694aab3
1 mainītis faili ar 7 papildinājumiem un 28 dzēšanām
  1. 7 28
      desktop/core/src/desktop/conf.py

+ 7 - 28
desktop/core/src/desktop/conf.py

@@ -227,40 +227,19 @@ SSL_CIPHER_LIST = Config(
   key="ssl_cipher_list",
   help=_("List of allowed and disallowed ciphers"),
 
-  # From https://wiki.mozilla.org/Security/Server_Side_TLS v3.7 default
-  # recommendation, which should be compatible with Firefox 1, Chrome 1, IE 7,
-  # Opera 5 and Safari 1.
+  # Based on "Intermediate compatibility" recommendations from
+  # https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29
+  # which should be compatible with Firefox 27, Chrome 31, IE 11,
+  # Opera 20 and Safari 9.
   default=':'.join([
     'ECDHE-RSA-AES128-GCM-SHA256',
     'ECDHE-ECDSA-AES128-GCM-SHA256',
     'ECDHE-RSA-AES256-GCM-SHA384',
     'ECDHE-ECDSA-AES256-GCM-SHA384',
     'DHE-RSA-AES128-GCM-SHA256',
-    'DHE-DSS-AES128-GCM-SHA256',
-    'kEDH+AESGCM',
-    'ECDHE-RSA-AES128-SHA256',
-    'ECDHE-ECDSA-AES128-SHA256',
-    'ECDHE-RSA-AES128-SHA',
-    'ECDHE-ECDSA-AES128-SHA',
-    'ECDHE-RSA-AES256-SHA384',
-    'ECDHE-ECDSA-AES256-SHA384',
-    'ECDHE-RSA-AES256-SHA',
-    'ECDHE-ECDSA-AES256-SHA',
-    'DHE-RSA-AES128-SHA256',
-    'DHE-RSA-AES128-SHA',
-    'DHE-DSS-AES128-SHA256',
-    'DHE-RSA-AES256-SHA256',
-    'DHE-DSS-AES256-SHA',
-    'DHE-RSA-AES256-SHA',
-    'AES128-GCM-SHA256',
-    'AES256-GCM-SHA384',
-    'AES128-SHA256',
-    'AES256-SHA256',
-    'AES128-SHA',
-    'AES256-SHA',
-    'AES',
-    'CAMELLIA',
-    'DES-CBC3-SHA',
+    'ECDHE-ECDSA-CHACHA20-POLY1305',
+    'ECDHE-RSA-CHACHA20-POLY1305',
+    'DHE-RSA-AES256-GCM-SHA384',
     '!aNULL',
     '!eNULL',
     '!EXPORT',