Re: [Pound Mailing List] Crime vulnerability on 2.7f upstream
Miroslav Danek <[email protected]>
| Newsgroups | gmane.comp.web.pound.general |
|---|---|
| Message-ID | <[email protected]> |
Hi Scott, i use stable 2.7, CentOS 6.6 + openssl 1.0.1e Mirek > On 10. 7. 2015, at 9:56, Scott McKeown <scott-Oteo70RhwZ77w/[email protected]> wrote: > > Hi Mirek, > > What version of pound are you using for this, we have as of yet net been able to get FS with pound... > > On 10 July 2015 at 08:31, Miroslav Danek <[email protected] <mailto:[email protected]>> wrote: > Hi Rick, > > i used this one: > > Disable SSLv3 > SSLAllowClientRenegotiation 0 > SSLHonorCipherOrder 1 > Ciphers "HIGH:!aNULL:!SSLv2:!ADH:!EXP:!eNULL:!RC4:MEDIUM:!LOW" > > Result A with FS. > > regards > Mirek > >> On 10. 7. 2015, at 9:07, Scott McKeown <scott-Oteo70RhwZ77w/[email protected] <mailto:scott-Oteo70RhwZ77w/[email protected]>> wrote: >> >> Hi Rick, >> >> Your current Cipher list is very open if you can give this one a go and let us know the report status (we get an A- with no FS) >> >> EECDH+ECDSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:ECDH+AESGCM:ECDH+AES256:ECDH+AES128:ECDH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!eNULL:!LOW:!aNULL:!MD5:!DSS >> >> If you could also post a sanitised copy of your pound config file we can see what we can do for you. >> >> >> >> >> On 9 July 2015 at 22:55, Rick Smith <[email protected] <mailto:[email protected]>> wrote: >> I am running Pound 2.7f from https://github.com/goochjj/pound/archive/stage_for_upstream/v2.7f.zip <https://github.com/goochjj/pound/archive/stage_for_upstream/v2.7f.zip> >> >> I am also running openssl version 1.01p from Jul 9, 2015. >> >> I am trying to achieve a better ranking for our SSL support. >> >> I have been able to move up to a C rating but for some reason here are my results. >> >> I am using the following ciphers: RC4-SHA:HIGH:!ADH:!SSLv2:!AES >> I enabled the Disable SSLv3 directive and I have the following also enabled for the listener: >> >> SSLAllowClientRenegotiation 0 >> SSLHonorCipherOrder 1 >> >> This is after much trial and error. I thought that this upstream version disabled TLS compression but it appears to still be active. >> >> Questions: >> >> 1) How can I disable TLS compression? >> 2) Can I enable TLS 1.1 and 1.2? >> 3) How can I disable support for weak DH key exchanges? >> 4) WHy isn't PFS enabled? I assume the ciphers need fixing? >> >> Thanks, >> >> Rick >> >> >> This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B. MORE INFO » <https://weakdh.org/> >> This server does not mitigate the CRIME attack <https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls>. Grade capped to C. >> The server supports only older protocols, but not the current best TLS 1.2. Grade capped to C. MORE INFO » <https://community.qualys.com/blogs/securitylabs/2015/05/22/ssl-labs-increased-penalty-when-tls-12-is-not-supported> >> This server accepts the RC4 cipher, which is weak. Grade capped to B. MORE INFO » <https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-is-broken-now-what> >> The server does not support Forward Secrecy with the reference browsers. MORE INFO » <https://en.wikipedia.org/wiki/Forward_secrecy> >> >> >> -- >> With Kind Regards. >> >> Scott McKeown >> Loadbalancer.org <http://loadbalancer.org/> >> http://www.loadbalancer.org <http://www.loadbalancer.org/> >> Tel (UK) - +44 (0) 3303801064 <tel:0%29%203303801064> (24x7) >> Tel (US) - +1 888.867.9504 <tel:%2B1%20888.867.9504> (Toll Free)(24x7) > > > > > -- > With Kind Regards. > > Scott McKeown > Loadbalancer.org > http://www.loadbalancer.org <http://www.loadbalancer.org/> > Tel (UK) - +44 (0) 3303801064 (24x7) > Tel (US) - +1 888.867.9504 (Toll Free)(24x7)