Prechádzať zdrojové kódy

[desktop] Explicitly set cipher list to Mozilla recommendation

Previously we were allowing most ciphers that OpenSSL supports.
Notably, this disables RC4. With this change we currently have
a grade of "C" from https://www.ssllabs.com because our version
of PyOpenSSL, 0.13, doesn't support TLS 1.1+, nor does it support
forward secrecy. That appears to have been added in 0.14.
Erick Tryzelaar 10 rokov pred
rodič
commit
d2620f60d0

+ 6 - 2
desktop/conf.dist/hue.ini

@@ -79,8 +79,12 @@
   ## ssl_password_script=
 
   # List of allowed and disallowed ciphers in cipher list format.
-  # See http://www.openssl.org/docs/apps/ciphers.html for more information on cipher list format.
-  ## ssl_cipher_list=DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2
+  # See http://www.openssl.org/docs/apps/ciphers.html for more information on
+  # cipher list format. This list is from
+  # https://wiki.mozilla.org/Security/Server_Side_TLS v3.7 intermediate
+  # recommendation, which should be compatible with Firefox 1, Chrome 1, IE 7,
+  # Opera 5 and Safari 1.
+  ## ssl_cipher_list=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
 
   # Path to default Certificate Authority certificates.
   ## ssl_cacerts=/etc/hue/cacerts.pem

+ 6 - 2
desktop/conf/pseudo-distributed.ini.tmpl

@@ -85,8 +85,12 @@
   ## ssl_password_script=
 
   # List of allowed and disallowed ciphers in cipher list format.
-  # See http://www.openssl.org/docs/apps/ciphers.html for more information on cipher list format.
-  ## ssl_cipher_list=DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2
+  # See http://www.openssl.org/docs/apps/ciphers.html for more information on
+  # cipher list format. This list is from
+  # https://wiki.mozilla.org/Security/Server_Side_TLS v3.7 intermediate
+  # recommendation, which should be compatible with Firefox 1, Chrome 1, IE 7,
+  # Opera 5 and Safari 1.
+  ## ssl_cipher_list=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
 
   # Path to default Certificate Authority certificates.
   ## ssl_cacerts=/etc/hue/cacerts.pem

+ 18 - 1
desktop/core/src/desktop/conf.py

@@ -96,7 +96,24 @@ SSL_PRIVATE_KEY = Config(
 SSL_CIPHER_LIST = Config(
   key="ssl_cipher_list",
   help=_("List of allowed and disallowed ciphers"),
-  default="DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2")
+
+  # From https://wiki.mozilla.org/Security/Server_Side_TLS v3.7 default
+  # recommendation, which should be compatible with Firefox 1, Chrome 1, IE 7,
+  # Opera 5 and Safari 1.
+  default=(
+      "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:"
+      "kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:"
+      "ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:"
+      "ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:"
+      "ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:"
+      "DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:"
+      "DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:"
+      "AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:"
+      "!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:"
+      "!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
+  ))
 
 SSL_PASSWORD = Config(
   key="ssl_password",