Bug 25948

Summary: Clean up apache protocols and ciphers
Product: Koha Reporter: Mark Tompsett <mtompset>
Component: Installation and upgrade (command-line installer)Assignee: Mark Tompsett <mtompset>
Status: Failed QA --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dcook, fridolin.somers
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 25948: Clean up apache-site-https a little

Description Mark Tompsett 2020-07-07 21:14:06 UTC
SSLCipherSuite was truncated and different between the OPAC and Intranet sections. While cleaning that up, removed TLSv1 as it is supposed to be deprecated already.
Comment 1 Mark Tompsett 2020-07-07 21:28:36 UTC
Created attachment 106645 [details] [review]
Bug 25948: Clean up apache-site-https a little

- removed ECDHE-RSA-AES256-SHA384, as it downgrades to CBC use
  https://ciphersuite.info/cs/TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384/
- added DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256
- added ECDHE-ECDSA-AES256-SHA384
- removed cut-off ECDHE-RSA-SA- and ECDHE-RSA-AES
- made OPAC and Intranet sections match
- removed TLSv1
    https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html
    https://blogs.windows.com/msedgedev/2020/03/31/tls-1-0-tls-1-1-schedule-update-edge-ie11/
    https://www.entrustdatacard.com/blog/2018/november/deprecating-tls
- did not remove TLSv1.1 as this would break support for older browsers
    probably still in use.
- did not add TLSv1.3 as it depends on OS used and version of openSSL if
    it is supported or not.

This may break support for some things, but nothing semi-current. I
don't care about ie 11 on windows 8.1 phones, or safari 6-8.

Also, people using letsencrypt.org should look into using a DNS CAA record
for their opac site URL, issued by letsencrypt.org with flags set to 0.

This affects the installation using:
sudo koha-create --letsencrypt --create-db instance

BEFORE using this command recently, I needed to disable the
000-default site, and had to create a directory
/usr/share/koha/intranet/htdocs/.well-known/acme-challenge
which I also softlinked from
/usr/share/koha/opac/htdocs/.well-known/acme-challenge to
the intranet one.
Comment 2 David Cook 2020-07-08 03:09:16 UTC
Comment on attachment 106645 [details] [review]
Bug 25948: Clean up apache-site-https a little

Review of attachment 106645 [details] [review]:
-----------------------------------------------------------------

::: debian/templates/apache-site-https.conf.in
@@ +12,4 @@
>  # OPAC
>  <VirtualHost *:80> #https
>  #  SSLEngine on
> +#  SSLProtocol -all +TLSv1.2 +TLSv1.1

TLSv1.1 is deprecated now too

Should include +TLSv1.3

@@ +39,4 @@
>  # Intranet
>  <VirtualHost *:80> #https
>  #  SSLEngine on
> +#  SSLProtocol -all +TLSv1.2 +TLSv1.1

TLSv1.1 is deprecated now too
 
Should include +TLSv1.3
Comment 3 David Cook 2020-07-08 03:10:55 UTC
It's great to see some updates here
Comment 4 Fridolin Somers 2022-03-10 06:57:02 UTC
> TLSv1.1 is deprecated now too
> Should include +TLSv1.3
Still valid ?
Comment 5 David Cook 2023-09-27 06:54:47 UTC
I took care of SSLProtocol on bug 34193 but the SSLCipherSuite probably could use some love...