فهرست منبع

[backend/core] remove weaker cipher suites from defaults

We are removing ECDHE-ECDSA-CHACHA20-POLY1305 specifically. Few other
suites are also removed as those aren't supported by gunicorn anyways.

Testing:
1. Run the following command to find the list of supported ciphers
   `nmap -sV --script +ssl-enum-ciphers -p $PORT $HOST`
2. Run the same command after the applying the change. You should find
   `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256` out of the supported
   list now.
Amit Srivastava 2 سال پیش
والد
کامیت
b2a2b97714
3فایلهای تغییر یافته به همراه2 افزوده شده و 8 حذف شده
  1. 1 1
      desktop/conf.dist/hue.ini
  2. 1 1
      desktop/conf/pseudo-distributed.ini.tmpl
  3. 0 6
      desktop/core/src/desktop/conf.py

+ 1 - 1
desktop/conf.dist/hue.ini

@@ -139,7 +139,7 @@ http_500_debug_mode=false
 # https://wiki.mozilla.org/Security/Server_Side_TLS v3.7 intermediate
 # recommendation, which should be compatible with Firefox 1, Chrome 1, IE 7,
 # Opera 5 and Safari 1.
-## ssl_cipher_list=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
+## ssl_cipher_list=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
 
 # Path to default Certificate Authority certificates.
 ## ssl_cacerts=/etc/hue/cacerts.pem

+ 1 - 1
desktop/conf/pseudo-distributed.ini.tmpl

@@ -144,7 +144,7 @@
   # https://wiki.mozilla.org/Security/Server_Side_TLS v3.7 intermediate
   # recommendation, which should be compatible with Firefox 1, Chrome 1, IE 7,
   # Opera 5 and Safari 1.
-  ## ssl_cipher_list=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
+  ## ssl_cipher_list=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
 
   # Path to default Certificate Authority certificates.
   ## ssl_cacerts=/etc/hue/cacerts.pem

+ 0 - 6
desktop/core/src/desktop/conf.py

@@ -254,13 +254,7 @@ SSL_CIPHER_LIST = Config(
   # Opera 20 and Safari 9.
   default=':'.join([
     'ECDHE-RSA-AES128-GCM-SHA256',
-    'ECDHE-ECDSA-AES128-GCM-SHA256',
     'ECDHE-RSA-AES256-GCM-SHA384',
-    'ECDHE-ECDSA-AES256-GCM-SHA384',
-    'DHE-RSA-AES128-GCM-SHA256',
-    'ECDHE-ECDSA-CHACHA20-POLY1305',
-    'ECDHE-RSA-CHACHA20-POLY1305',
-    'DHE-RSA-AES256-GCM-SHA384',
     '!aNULL',
     '!eNULL',
     '!EXPORT',