Bug 25948 - Clean up apache protocols and ciphers
Summary: Clean up apache protocols and ciphers
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Installation and upgrade (command-line installer) (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Mark Tompsett
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-07-07 21:14 UTC by Mark Tompsett
Modified: 2023-09-27 06:55 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 25948: Clean up apache-site-https a little (3.69 KB, patch)
2020-07-07 21:28 UTC, Mark Tompsett
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Tompsett 2020-07-07 21:14:06 UTC
SSLCipherSuite was truncated and different between the OPAC and Intranet sections. While cleaning that up, removed TLSv1 as it is supposed to be deprecated already.
Comment 1 Mark Tompsett 2020-07-07 21:28:36 UTC
Created attachment 106645 [details] [review]
Bug 25948: Clean up apache-site-https a little

- removed ECDHE-RSA-AES256-SHA384, as it downgrades to CBC use
  https://ciphersuite.info/cs/TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384/
- added DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256
- added ECDHE-ECDSA-AES256-SHA384
- removed cut-off ECDHE-RSA-SA- and ECDHE-RSA-AES
- made OPAC and Intranet sections match
- removed TLSv1
    https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html
    https://blogs.windows.com/msedgedev/2020/03/31/tls-1-0-tls-1-1-schedule-update-edge-ie11/
    https://www.entrustdatacard.com/blog/2018/november/deprecating-tls
- did not remove TLSv1.1 as this would break support for older browsers
    probably still in use.
- did not add TLSv1.3 as it depends on OS used and version of openSSL if
    it is supported or not.

This may break support for some things, but nothing semi-current. I
don't care about ie 11 on windows 8.1 phones, or safari 6-8.

Also, people using letsencrypt.org should look into using a DNS CAA record
for their opac site URL, issued by letsencrypt.org with flags set to 0.

This affects the installation using:
sudo koha-create --letsencrypt --create-db instance

BEFORE using this command recently, I needed to disable the
000-default site, and had to create a directory
/usr/share/koha/intranet/htdocs/.well-known/acme-challenge
which I also softlinked from
/usr/share/koha/opac/htdocs/.well-known/acme-challenge to
the intranet one.
Comment 2 David Cook 2020-07-08 03:09:16 UTC
Comment on attachment 106645 [details] [review]
Bug 25948: Clean up apache-site-https a little

Review of attachment 106645 [details] [review]:
-----------------------------------------------------------------

::: debian/templates/apache-site-https.conf.in
@@ +12,4 @@
>  # OPAC
>  <VirtualHost *:80> #https
>  #  SSLEngine on
> +#  SSLProtocol -all +TLSv1.2 +TLSv1.1

TLSv1.1 is deprecated now too

Should include +TLSv1.3

@@ +39,4 @@
>  # Intranet
>  <VirtualHost *:80> #https
>  #  SSLEngine on
> +#  SSLProtocol -all +TLSv1.2 +TLSv1.1

TLSv1.1 is deprecated now too
 
Should include +TLSv1.3
Comment 3 David Cook 2020-07-08 03:10:55 UTC
It's great to see some updates here
Comment 4 Fridolin Somers 2022-03-10 06:57:02 UTC
> TLSv1.1 is deprecated now too
> Should include +TLSv1.3
Still valid ?
Comment 5 David Cook 2023-09-27 06:54:47 UTC
I took care of SSLProtocol on bug 34193 but the SSLCipherSuite probably could use some love...