Kryptografie/Webserver: Unterschied zwischen den Versionen
K Textersetzung - „Apache2 “ durch „Apache “ |
|||
Zeile 48: | Zeile 48: | ||
==== References ==== | ==== References ==== | ||
[https://httpd.apache.org/docs/2.4/ssl/ | [https://httpd.apache.org/docs/2.4/ssl/ Apache Docs on SSL and TLS] | ||
==== How to test ==== | ==== How to test ==== |
Aktuelle Version vom 3. November 2024, 14:04 Uhr
Apache
Note that any cipher suite starting with EECDH can be omitted, if in doubt. (Compared to the theory section, EECDH in Apache and ECDHE in OpenSSL are synonyms [4])
Tested with Versions
- Apache 2.2.22, Debian Wheezy with OpenSSL 1.0.1e
- Apache 2.4.6, Debian Jessie with OpenSSL 1.0.1e
- Apache 2.4.10, Debian Jessie 8.2 with OpenSSL 1.0.1k
- Apache 2.4.7, Ubuntu 14.04.2 Trusty with OpenSSL 1.0.1f
- Apache 2.4.6, CentOS Linux 7 (Core) with OpenSSL 1.0.1e
- Apache 2.4.18, Ubuntu 16.04.3 LTS with OpenSSL 1.0.2g
Settings
Enabled modules SSL and Headers are required.
- SSL configuration for an Apache vhost
SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder On SSLCompression off Header always set Strict-Transport-Security "max-age=15768000" # Strict-Transport-Security: "max-age=15768000 ; includeSubDomains" Header always set Public-Key-Pins "pin-sha256=\"YOUR_HASH=\"; pin-sha256=\"YOUR_BACKUP_HASH=\"; max-age=7776000; report-uri=\"https://YOUR.REPORT.URL\"" SSLCipherSuite 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA'
Add six earth month HSTS header for all users… | |
If you want to protect all subdomains, use the following header. ALL subdomains HAVE TO support HTTPS if you use this! | |
CALL subdomains HAVE TO support HTTPS if you use this! At least use one Backup-Key and/or add whole CA, think of Cert-Updates! |
Additional settings
You might want to redirect everything to https:// if possible. In Apache you can do this with the following setting inside of a VirtualHost environment:
- https auto-redirect vhost
<VirtualHost *:80> Redirect permanent / https://SERVER_NAME/ </VirtualHost>
References
How to test
See appendix Tools
lighttpd
Tested with Versions
- lighttpd/1.4.31-4 with OpenSSL 1.0.1e on Debian Wheezy
- lighttpd/1.4.33 with OpenSSL 0.9.8o on Debian Squeeze (note that TLSv1.2 does not work in openssl 0.9.8 thus not all ciphers actually work)
- lighttpd/1.4.28-2 with OpenSSL 0.9.8o on Debian Squeeze (note that TLSv1.2 does not work in openssl 0.9.8 thus not all ciphers actually work)
- lighttpd/1.4.31, Ubuntu 14.04.2 Trusty with Openssl 1.0.1f
Settings
- SSL configuration for lighttpd
$SERVER["socket"] == "0.0.0.0:443" { ssl.engine = "enable" ssl.use-sslv2 = "disable" ssl.use-sslv3 = "disable" ssl.pemfile = "/etc/lighttpd/server.pem" ssl.ca-file = "/etc/ssl/certs/server.crt" ssl.cipher-list = "EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA" ssl.honor-cipher-order = "enable" setenv.add-response-header = ( "Strict-Transport-Security" => "max-age=15768000") # six months # use this only if all subdomains support HTTPS! # setenv.add-response-header = ( "Strict-Transport-Security" => "max-age=15768000; includeSubDomains") }
Starting with lighttpd version 1.4.29 Diffie-Hellman and Elliptic-Curve Diffie-Hellman key agreement protocols are supported. By default, elliptic curve "prime256v1" (also "secp256r1") will be used, if no other is given. To select special curves, it is possible to set them using the configuration options ssl.dh-file and ssl.ec-curve.
- SSL EC/DH configuration for lighttpd
# use group16 dh parameters ssl.dh-file = "/etc/lighttpd/ssl/dh4096.pem" ssl.ec-curve = "secp384r1"
Please read section A note on Diffie Hellman Key Exchanges for more information on Diffie Hellman key exchange and elliptic curves.
Additional settings
As for any other webserver, you might want to automatically redirect http:// traffic toward https://. It is also recommended to set the environment variable HTTPS, so the PHP applications run by the webserver can easily detect that HTTPS is in use.
- https auto-redirect configuration
$HTTP["scheme"] == "http" { # capture vhost name with regex condition -> %0 in redirect pattern # must be the most inner block to the redirect rule $HTTP["host"] =~ ".*" { url.redirect = (".*" => "https://%0$0") } # Set the environment variable properly setenv.add-environment = ( "HTTPS" => "on" ) }
Additional information
The config option honor-cipher-order is available since 1.4.30, the supported ciphers depend on the used OpenSSL-version (at runtime). ECDHE has to be available in OpenSSL at compile-time, which should be default. SSL compression should by deactivated by default at compile-time (if not, it’s active). Support for other SSL-libraries like GnuTLS will be available in the upcoming 2.x branch, which is currently under development.
References
- How to redirect HTTP requests to HTTPS
- Lighttpd Docs: Secure HTTP
- Release 1.4.30 (How to mitigate BEAST attack)
- Lightpd issue: SSL Compression disabled by default
How to test
See appendix Tools
nginx
Tested with Version
- 1.4.4 with OpenSSL 1.0.1e on OS X Server 10.8.5
- 1.2.1-2.2+wheezy2 with OpenSSL 1.0.1e on Debian Wheezy
- 1.4.4 with OpenSSL 1.0.1e on Debian Wheezy
- 1.2.1-2.2 bpo60+2 with OpenSSL 0.9.8o on Debian Squeeze (note that TLSv1.2 does not work in openssl 0.9.8 thus not all ciphers actually work)
- 1.4.6 with OpenSSL 1.0.1f on Ubuntu 14.04.2 LTS
Settings
- SSL settings for nginx
ssl on; ssl_certificate cert.pem; ssl_certificate_key cert.key; ssl_session_timeout 5m; ssl_prefer_server_ciphers on; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # not possible to do exclusive ssl_ciphers 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA'; add_header Strict-Transport-Security "max-age=15768000"; # six months # add_header Strict-Transport-Security "max-age=15768000; includeSubDomains";
Use this only if all subdomains support HTTPS! |
If you absolutely want to specify your own DH parameters, you can specify them via ssl_dhparam file. However, we advise you to read section A note on Diffie Hellman Key Exchanges and stay with the standard IKE/IETF parameters (as long as they are >1024 bits).
Additional settings
If you decide to trust NIST’s ECC curve recommendation, you can add the following line to nginx’s configuration file to select special curves:
- SSL EC/DH settings for nginx
ssl_ecdh_curve secp384r1;
You might want to redirect everything to https:// if possible. In Nginx you can do this with the following setting:
- https auto-redirect in nginx
return 301 https://$server_name$request_uri;
The variable $server_name refers to the first server_name entry in your config file. If you specify more than one server_name only the first will be taken. Please be sure to not use the $host variable here because it contains data controlled by the user.
References
How to test
See appendix Tools
Cherokee
Tested with Version
- Cherokee/1.2.104 on Debian Wheezy with OpenSSL 1.0.1e 11 Feb 2013
Settings
The configuration of the cherokee webserver is performed by an admin interface available via the web. It then writes the configuration to /etc/cherokee/cherokee.conf, the important lines of such a configuration file can be found at the end of this section.
- General Settings
- Network
- SSL/TLS back-end: OpenSSL/libssl
- Ports to listen
- Port: 443, TLS: TLS/SSL port
- Network
- Virtual Servers, For each vServer on tab Security:
- Required SSL/TLS Values: Fill in the correct paths for Certificate and Certificate key
- Advanced Options
- Ciphers:
EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA- Server Preference: Prefer
- Compression: Disabled
- Ciphers:
- Advanced: TLS
- SSL version 2 and SSL version 3: No
- TLS version 1, TLS version 1.1 and TLS version 1.2: Yes
Additional settings
For each vServer on the Security tab it is possible to set the Diffie Hellman length to up to 4096 bits. We recommend to use >1024 bits. More information about Diffie-Hellman and which curves are recommended can be found in section A note on Diffie Hellman Key Exchanges. In Advanced: TLS it is possible to set the path to a Diffie Hellman parameters file for 512, 1024, 2048 and 4096 bits. HSTS can be configured on host-basis in section vServers / Security / HTTP Strict Transport Security (HSTS):* Enable HSTS: Accept
- HSTS Max-Age: 15768000
- Include Subdomains: depends on your setup
To redirect HTTP to HTTPS, configure a new rule per Virtual Server in the Behavior tab. The rule is SSL/TLS combined with a NOT operator. As Handler define Redirection and use /(.*)$ as Regular Expression and +https://$\{host}/$1+ as Substitution.
- SSL configuration for cherokee
server!bind!2!port = 443 server!bind!2!tls = 1 server!tls = libssl vserver!1!hsts = 1 vserver!1!hsts!max_age = 15768000 vserver!1!hsts!subdomains = 1 vserver!1!rule!5!handler = redir vserver!1!rule!5!handler!rewrite!10!regex = /(.*)$ vserver!1!rule!5!handler!rewrite!10!show = 1 vserver!1!rule!5!handler!rewrite!10!substring = https://${host}/$1 vserver!1!rule!5!handler!type = just_about vserver!1!rule!5!match = not vserver!1!rule!5!match!right = tls vserver!1!ssl_certificate_file = /etc/ssl/certs/ssl-cert-snakeoil.pem vserver!1!ssl_certificate_key_file = /etc/ssl/private/ssl-cert-snakeoil.key vserver!1!ssl_cipher_server_preference = 1 vserver!1!ssl_ciphers = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA vserver!1!ssl_compression = 0 vserver!1!ssl_dh_length = 2048
References
How to test
See appendix Tools
MS IIS
To configure SSL/TLS on Windows Server IIS Crypto can be used. Simply start the Programm, no installation required. The tool changes the registry keys described below. A restart is required for the changes to take effect. "IIS Crypto Tool" Instead of using the IIS Crypto Tool the configuration can be set using the Windows Registry. The following Registry keys apply to the newer Versions of Windows (Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012 and Windows Server 2012 R2). For detailed information about the older versions see the Microsoft knowledgebase article How to restrict the use of certain cryptographic algorithms and protocols in Schannel.dll.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Ciphers] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\CipherSuites] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Hashes] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\KeyExchangeAlgorithms] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols]
Tested with Version
- Windows Server 2008
- Windows Server 2008 R2
- Windows Server 2012
- Windows Server 2012 R2
- Windows Vista and Internet Explorer 7 and upwards
- Windows 7 and Internet Explorer 8 and upwards
- Windows 8 and Internet Explorer 10 and upwards
- Windows 8.1 and Internet Explorer 11
Settings
When trying to avoid RC4 (RC4 biases) as well as CBC (BEAST-Attack) by using GCM and to support perfect forward secrecy, Microsoft SChannel (SSL/TLS, Auth,.. Stack) supports ECDSA but lacks support for RSA signatures (see ECC suite B doubts). Since one is stuck with ECDSA, an elliptic curve certificate needs to be used. The configuration of cipher suites MS IIS will use, can be configured in one of the following ways:# Group Policy: Prioritizing Schannel Cipher Suites
- Registry: How to restrict the use of certain cryptographic algorithms and protocols in Schannel.dll
- IIS Crypto
- Powershell
Table Client support shows the process of turning on one algorithm after another and the effect on the supported clients tested using https://www.ssllabs.com. SSL 3.0, SSL 2.0 and MD5 are turned off. TLS 1.0 and TLS 1.2 are turned on. Table 1. Client support
Cipher Suite | Client |
---|---|
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256+ | only IE 10,11, OpenSSL 1.0.1e |
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256+ | Chrome 30, Opera 17, Safari 6+ |
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA+ | FF 10-24, IE 8+, Safari 5, Java 7 |
Table Client support shows the algorithms from strongest to weakest and why they need to be added in this order. For example insisting on SHA-2 algorithms (only first two lines) would eliminate all versions of Firefox, so the last line is needed to support this browser, but should be placed at the bottom, so capable browsers will choose the stronger SHA-2 algorithms. TLS_RSA_WITH_RC4_128_SHA or equivalent should also be added if MS Terminal Server Connection is used (make sure to use this only in a trusted environment). This suite will not be used for SSL, since we do not use a RSA Key.
Clients not supported:
- Java 6
- WinXP
- Bing
Additional settings
It’s recommended to use ´Strict-Transport-Security: max-age=15768000` for detailed information visit the Microsoft knowledgebase article in custom Headers. You might want to redirect everything to https:// if possible. In IIS you can do this with the following setting by Powershell: Set-WebConfiguration -Location "$WebSiteName/$WebApplicationName" `
-Filter 'system.webserver/security/access' ` -Value "SslRequireCert"
Justification for special settings (if needed)
References
- How to restrict the use of certain cryptographic algorithms and protocols in Schannel.dll
- How to disable PCT 1.0, SSL 2.0, SSL 3.0, or TLS 1.0 in Internet Information Services
How to test
See appendix Tools