Re: EZproxy SSL Cipher

This should have been a very easy answer from support.  At this point,
disabling triple DES should cause no issues at all, and you should not see
it in use in anything that is maintained properly after 2023 (
https://www.cryptomathic.com/news-events/blog/3des-is-officially-being-retired
).

On some software, you can specify the incoming and outgoing cipher suite
separately, but the OCLC documentation is not clear if SSLCipherSuite
applies to both directions or not, so I'm assuming that it applies to both
directions.  If there is a way to separate the incoming and outgoing
settings, at this point you can safely be more strict on the incoming
client connections (from browsers) and more permissive on the outgoing
server connections (to vendor platforms).

A great resource for current best practice SSL settings can be found at
https://ssl-config.mozilla.org/, and the closest server software to EZproxy
would be Apache.  You'll need to check the availability of the ciphers that
OCLC ships with EZproxy, as I do not remember how EZproxy behaves when
given a cipher string it does not recognize (ignore vs. reject).

For now, I'd stick with the "intermediate" configuration instead of
"modern"; TLS 1.3 support is pretty good, but may not be adopted
quite widely enough yet for general use (https://caniuse.com/#feat=tls1-3).

You can also use the openssl command line client to test specific ciphers
if you want to do your own verification that the new cipher set will work
at the vendor platforms:
https://security.stackexchange.com/questions/46197/force-a-specific-ssl-cipher

Andrew

On Tue, Nov 19, 2019 at 9:29 AM Matthew Gray <[email protected]> wrote:

> Hi all,
>
>
>
> Does anyone have any experience with disabling specific SSL cipher
> directives to resolve a security concern? My IT department contacted me
> about disabling a specific directive in EZproxy and I need to know if it
> will have any unexpected consequences. I reached out to support and OCLC
> indicated that EZproxy would be fine but they could not speak to any issues
> that may arise with individual vendors/access.
>
>
>
>
>
> *See highlighted ciphers:*
>
>
>
> SSLHonorCipherOrder On
>
>
>
> SSLCipherSuite
> ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES
> :DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5
>
>
>
>
>
> Matthew Gray
>
> Instructor, Information Science
>
> Systems and Reference Librarian
>
> University of the Sciences
>
> 600 S. 43rd St., Philadelphia, PA 19104
>
> 267.295.3187
>
>
>
> ------------------------------
>
> To unsubscribe from the EZPROXY-L list, click the following link:
> http://listserv.oclclists.org/scripts/wa.exe?SUBED1=EZPROXY-L&A=1
>


-- 

Andrew Anderson
President & CEO
[email protected]
t: +1 (727) 536-0214 x100
f: +1 (727) 530-3126
w: www.lirn.net
Library & Information Resources Network
25400 US Hwy 19 North, Ste. #220
Clearwater, FL 33763
LinkedIn
<http://www.linkedin.com/company/library-and-information-resources-network-inc->
 | Facebook <http://www.facebook.com/LIRNnotes> | Twitter
<http://www.twitter.com/LIRNNotes> | YouTube
<http://www.youtube.com/user/LIRNnotes>


********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].