Re: [Pound Mailing List] Crime vulnerability on 2.7f upstream

Hi Joe, we have been playing with your recommended url and we haven't
obtained an A+ in anyway, on other hand we have applied the Frank's patch:

http://www.apsis.ch/pound/pound_list/archive/2014/2014-09/1411468078000

for your pound2.8a and we have received an +A of SSLlabs.

Currently we haven't found any way of obtain this result without apply this.

Thanks and regards



2015-07-10 20:32 GMT+02:00 Joe Gooch <[email protected]>:

> Yeah I think this is what you need for A+
>
>
> https://raymii.org/s/tutorials/HTTP_Strict_Transport_Security_for_Apache_NGINX_and_Lighttpd.html
>
> This site goes through X-Frame-Options for IIS and HAProxy – if you adapt
> it for the HTTP-Strict-Transport-Security examples from the first link, it
> should work for you.
>
> https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options
>
> --
> Joe
>
> Confidentiality Notice: This e-mail transmission may contain confidential
> and legally privileged information that is intended only for the individual
> named in the e-mail address. If you are not the intended recipient, you are
> hereby notified that any disclosure, copying, distribution, or reliance
> upon the contents of this e-mail message is strictly prohibited. If you
> have received this e-mail transmission in error, please reply to the
> sender, so that proper delivery can be arranged, and please delete the
> message from your mail box.
>
>
>
> From: Emilio Campos
> Reply-To: "[email protected]"
> Date: Friday, July 10, 2015 at 11:40 AM
>
> To: "[email protected]"
> Subject: Re: [Pound Mailing List] Crime vulnerability on 2.7f upstream
>
> Joe, really appreciate your help, thank you so much, I will test it.
>
> Regards!
>
> 2015-07-10 17:24 GMT+02:00 Joe Gooch <[email protected]>:
>
>> IIRC you'd have to have a 2048bit dh key, and/or possibly HSTS headers.
>>
>> openssl dhparam -5 2048 -out dh2048.pem
>>
>> Then specify the file for Pound in your config:
>> DHParams        "/path/to/dh2048.pem"
>> ECDHCurve       prime256v1
>>
>> --
>> Joe
>>
>> Confidentiality Notice: This e-mail transmission may contain confidential
>> and legally privileged information that is intended only for the individual
>> named in the e-mail address. If you are not the intended recipient, you are
>> hereby notified that any disclosure, copying, distribution, or reliance
>> upon the contents of this e-mail message is strictly prohibited. If you
>> have received this e-mail transmission in error, please reply to the
>> sender, so that proper delivery can be arranged, and please delete the
>> message from your mail box.
>>
>>
>>
>> From: Emilio Campos
>> Reply-To: "[email protected]"
>> Date: Friday, July 10, 2015 at 8:02 AM
>> To: "[email protected]"
>> Subject: Re: [Pound Mailing List] Crime vulnerability on 2.7f upstream
>>
>> By the way, someone can obtain a A+ with pound2.7 or higher? In my case I
>> use 2.8.a with only A.
>>
>>
>> Thanks!
>>
>>
>> 2015-07-10 10:44 GMT+02:00 Scott McKeown <scott-Oteo70RhwZ77w/[email protected]>:
>>
>>> Hi Mirek,
>>>
>>> Thanks, I'm guessing that there must be an additional patch in v2.7 that
>>> I've not used in our build
>>>
>>> Time to do some more testing I guess.
>>>
>>>
>>>
>>>
>>> On 10 July 2015 at 09:20, Miroslav Danek <[email protected]> wrote:
>>>
>>>> Hi Scott,
>>>>
>>>> i use stable 2.7, CentOS 6.6 + openssl 1.0.1e
>>>>
>>>>
>>>> Mirek
>>>>
>>>> On 10. 7. 2015, at 9:56, Scott McKeown <scott-Oteo70RhwZ77w/[email protected]> wrote:
>>>>
>>>> Hi Mirek,
>>>>
>>>> What version of pound are you using for this, we have as of yet net
>>>> been able to get FS with pound...
>>>>
>>>> On 10 July 2015 at 08:31, Miroslav Danek <[email protected]> wrote:
>>>>
>>>>> Hi Rick,
>>>>>
>>>>> i used this one:
>>>>>
>>>>> Disable SSLv3
>>>>> SSLAllowClientRenegotiation 0
>>>>> SSLHonorCipherOrder 1
>>>>> Ciphers "HIGH:!aNULL:!SSLv2:!ADH:!EXP:!eNULL:!RC4:MEDIUM:!LOW"
>>>>>
>>>>> Result A with FS.
>>>>>
>>>>> regards
>>>>> Mirek
>>>>>
>>>>> On 10. 7. 2015, at 9:07, Scott McKeown <scott-Oteo70RhwZ77w/[email protected]> wrote:
>>>>>
>>>>> Hi Rick,
>>>>>
>>>>> Your current Cipher list is very open if you can give this one a go
>>>>> and let us know the report status (we get an A- with no FS)
>>>>>
>>>>> EECDH+ECDSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+
>>>>> SHA256:ECDH+AESGCM:ECDH+AES256:ECDH+AES128:ECDH+3DES:
>>>>> RSA+AESGCM:RSA+AES:RSA+3DES:!eNULL:!LOW:!aNULL:!MD5:!DSS
>>>>>
>>>>> If you could also post a sanitised copy of your pound config file we
>>>>> can see what we can do for you.
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On 9 July 2015 at 22:55, Rick Smith <[email protected]> wrote:
>>>>>
>>>>>> I am running Pound 2.7f from
>>>>>> https://github.com/goochjj/pound/archive/stage_for_upstream/v2.7f.zip
>>>>>>
>>>>>>
>>>>>> I am also running openssl version 1.01p from Jul 9, 2015.
>>>>>>
>>>>>> I am trying to achieve a better ranking for our SSL support.
>>>>>>
>>>>>> I have been able to move up to a C rating but for some reason here
>>>>>> are my results.
>>>>>>
>>>>>> I am using the following ciphers: RC4-SHA:HIGH:!ADH:!SSLv2:!AES
>>>>>> I enabled the Disable SSLv3 directive and I have the following also
>>>>>> enabled for the listener:
>>>>>>
>>>>>> SSLAllowClientRenegotiation     0
>>>>>> SSLHonorCipherOrder 1
>>>>>>
>>>>>> This is after much trial and error.  I thought that this upstream
>>>>>> version disabled TLS compression but it appears to still be active.
>>>>>>
>>>>>> Questions:
>>>>>>
>>>>>> 1)  How can I disable TLS compression?
>>>>>> 2)  Can I enable TLS 1.1 and 1.2?
>>>>>> 3)  How can I disable support for weak DH key exchanges?
>>>>>> 4)  WHy isn't PFS enabled?  I assume the ciphers need fixing?
>>>>>>
>>>>>> Thanks,
>>>>>>
>>>>>> Rick
>>>>>>
>>>>>>
>>>>>> This server supports weak Diffie-Hellman (DH) key exchange
>>>>>> parameters. Grade capped to B.   MORE INFO » <https://weakdh.org/>
>>>>>> This server does not mitigate the CRIME attack
>>>>>> <https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls>.
>>>>>> Grade capped to C.
>>>>>> The server supports only older protocols, but not the current best
>>>>>> TLS 1.2. Grade capped to C.  MORE INFO »
>>>>>> <https://community.qualys.com/blogs/securitylabs/2015/05/22/ssl-labs-increased-penalty-when-tls-12-is-not-supported>
>>>>>> This server accepts the RC4 cipher, which is weak. Grade capped to B.
>>>>>>  MORE INFO »
>>>>>> <https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-is-broken-now-what>
>>>>>> The server does not support Forward Secrecy with the reference
>>>>>> browsers.  MORE INFO »
>>>>>> <https://en.wikipedia.org/wiki/Forward_secrecy>
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> With Kind Regards.
>>>>>
>>>>> Scott McKeown
>>>>> Loadbalancer.org <http://loadbalancer.org/>
>>>>> http://www.loadbalancer.org
>>>>> Tel (UK) - +44 (0) 3303801064 (24x7)
>>>>> Tel (US) - +1 888.867.9504 (Toll Free)(24x7)
>>>>>
>>>>>
>>>>>
>>>>
>>>>
>>>> --
>>>> With Kind Regards.
>>>>
>>>> Scott McKeown
>>>> Loadbalancer.org
>>>> http://www.loadbalancer.org
>>>> Tel (UK) - +44 (0) 3303801064 (24x7)
>>>> Tel (US) - +1 888.867.9504 (Toll Free)(24x7)
>>>>
>>>>
>>>>
>>>
>>>
>>> --
>>> With Kind Regards.
>>>
>>> Scott McKeown
>>> Loadbalancer.org
>>> http://www.loadbalancer.org
>>> Tel (UK) - +44 (0) 3303801064 (24x7)
>>> Tel (US) - +1 888.867.9504 (Toll Free)(24x7)
>>>
>>
>>
>>
>> --
>> Load balancer distribution - Open Source Project
>> http://www.zenloadbalancer.com
>> Distribution list (subscribe):
>> zenloadbalancer-support-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
>>
>
>
>
> --
> Load balancer distribution - Open Source Project
> http://www.zenloadbalancer.com
> Distribution list (subscribe):
> zenloadbalancer-support-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
>



-- 
Load balancer distribution - Open Source Project
http://www.zenloadbalancer.com
Distribution list (subscribe): zenloadbalancer-support-5NWGOfrQmneRv+LV9MX5uv+2+P5yyue3@public.gmane.orgt