Re: [Pound Mailing List] Crime vulnerability on 2.7f upstream

By the way, someone can obtain a A+ with pound2.7 or higher? In my case I
use 2.8.a with only A.


Thanks!


2015-07-10 10:44 GMT+02:00 Scott McKeown <scott-Oteo70RhwZ77w/[email protected]>:

> Hi Mirek,
>
> Thanks, I'm guessing that there must be an additional patch in v2.7 that
> I've not used in our build
>
> Time to do some more testing I guess.
>
>
>
>
> On 10 July 2015 at 09:20, Miroslav Danek <[email protected]> wrote:
>
>> Hi Scott,
>>
>> i use stable 2.7, CentOS 6.6 + openssl 1.0.1e
>>
>>
>> Mirek
>>
>> On 10. 7. 2015, at 9:56, Scott McKeown <scott-Oteo70RhwZ77w/[email protected]> wrote:
>>
>> Hi Mirek,
>>
>> What version of pound are you using for this, we have as of yet net been
>> able to get FS with pound...
>>
>> On 10 July 2015 at 08:31, Miroslav Danek <[email protected]> wrote:
>>
>>> Hi Rick,
>>>
>>> i used this one:
>>>
>>> Disable SSLv3
>>> SSLAllowClientRenegotiation 0
>>> SSLHonorCipherOrder 1
>>> Ciphers "HIGH:!aNULL:!SSLv2:!ADH:!EXP:!eNULL:!RC4:MEDIUM:!LOW"
>>>
>>> Result A with FS.
>>>
>>> regards
>>> Mirek
>>>
>>> On 10. 7. 2015, at 9:07, Scott McKeown <scott-Oteo70RhwZ77w/[email protected]> wrote:
>>>
>>> Hi Rick,
>>>
>>> Your current Cipher list is very open if you can give this one a go and
>>> let us know the report status (we get an A- with no FS)
>>>
>>> EECDH+ECDSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+
>>> SHA256:ECDH+AESGCM:ECDH+AES256:ECDH+AES128:ECDH+3DES:
>>> RSA+AESGCM:RSA+AES:RSA+3DES:!eNULL:!LOW:!aNULL:!MD5:!DSS
>>>
>>> If you could also post a sanitised copy of your pound config file we can
>>> see what we can do for you.
>>>
>>>
>>>
>>>
>>> On 9 July 2015 at 22:55, Rick Smith <[email protected]> wrote:
>>>
>>>> I am running Pound 2.7f from
>>>> https://github.com/goochjj/pound/archive/stage_for_upstream/v2.7f.zip
>>>>
>>>> I am also running openssl version 1.01p from Jul 9, 2015.
>>>>
>>>> I am trying to achieve a better ranking for our SSL support.
>>>>
>>>> I have been able to move up to a C rating but for some reason here are
>>>> my results.
>>>>
>>>> I am using the following ciphers: RC4-SHA:HIGH:!ADH:!SSLv2:!AES
>>>> I enabled the Disable SSLv3 directive and I have the following also
>>>> enabled for the listener:
>>>>
>>>> SSLAllowClientRenegotiation     0
>>>> SSLHonorCipherOrder 1
>>>>
>>>> This is after much trial and error.  I thought that this upstream
>>>> version disabled TLS compression but it appears to still be active.
>>>>
>>>> Questions:
>>>>
>>>> 1)  How can I disable TLS compression?
>>>> 2)  Can I enable TLS 1.1 and 1.2?
>>>> 3)  How can I disable support for weak DH key exchanges?
>>>> 4)  WHy isn't PFS enabled?  I assume the ciphers need fixing?
>>>>
>>>> Thanks,
>>>>
>>>> Rick
>>>>
>>>>
>>>> This server supports weak Diffie-Hellman (DH) key exchange parameters.
>>>> Grade capped to B.   MORE INFO » <https://weakdh.org/>
>>>> This server does not mitigate the CRIME attack
>>>> <https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls>.
>>>> Grade capped to C.
>>>> The server supports only older protocols, but not the current best TLS
>>>> 1.2. Grade capped to C.  MORE INFO »
>>>> <https://community.qualys.com/blogs/securitylabs/2015/05/22/ssl-labs-increased-penalty-when-tls-12-is-not-supported>
>>>> This server accepts the RC4 cipher, which is weak. Grade capped to B.
>>>> MORE INFO »
>>>> <https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-is-broken-now-what>
>>>> The server does not support Forward Secrecy with the reference
>>>> browsers.  MORE INFO » <https://en.wikipedia.org/wiki/Forward_secrecy>
>>>>
>>>
>>>
>>>
>>> --
>>> With Kind Regards.
>>>
>>> Scott McKeown
>>> Loadbalancer.org <http://loadbalancer.org/>
>>> http://www.loadbalancer.org
>>> Tel (UK) - +44 (0) 3303801064 (24x7)
>>> Tel (US) - +1 888.867.9504 (Toll Free)(24x7)
>>>
>>>
>>>
>>
>>
>> --
>> With Kind Regards.
>>
>> Scott McKeown
>> Loadbalancer.org
>> http://www.loadbalancer.org
>> Tel (UK) - +44 (0) 3303801064 (24x7)
>> Tel (US) - +1 888.867.9504 (Toll Free)(24x7)
>>
>>
>>
>
>
> --
> With Kind Regards.
>
> Scott McKeown
> Loadbalancer.org
> http://www.loadbalancer.org
> Tel (UK) - +44 (0) 3303801064 (24x7)
> Tel (US) - +1 888.867.9504 (Toll Free)(24x7)
>



-- 
Load balancer distribution - Open Source Project
http://www.zenloadbalancer.com
Distribution list (subscribe): zenloadbalancer-support-5NWGOfrQmneRv+LV9MX5uv+2+P5yyue3@public.gmane.orgt