Default cipherSuites setting breaks SOAP on RedHat
Description
Environment
RHEL/CentOS 6, RHEL/CentOS 7
Shib SP 2.6.0
openssl-1.0.1e-48.el6_8.1.x86_64
Attachments
Activity
Scott Cantor March 21, 2018 at 9:04 PM
I checked in a variant of that expression into all the default files. I'd rather do that than adjust the library default, but we might still consider some tightening there. Less risky to do it in the files since it doesn't impact upgrades.
Rod Widdowson March 20, 2018 at 11:06 AM
The change to remove the restrive defaults for non windows is already in shibboleth3.xml
Further disucssions on what is appropriate is probably relevant but I don't feel like I'm the one to do it.
Scott Cantor November 13, 2017 at 10:10 PM
We can consider it, but it's a 3.0 thing obviously, no time to reconsider this for the patch.
Vlad Mencl November 13, 2017 at 9:57 PM
Hi,
FYI, I've just rolled out in Tuakiri (so far, for our internal systems, but also included in our SP Install manual) a slightly different version of the expression: instead of relying on the exact cipher names to permit, use the "DEFAULT" and blacklist everything we do NOT want (older protocol versions, weak ciphers). This is based on the SSLCipherSuites line that comes with Apache - but added more ciphersuites and protocols to disable as per latest developments.
My line is:
And e.g. on CentOS7, I get:
This approach seems to work consistently across different platforms - would that sound acceptable for inclusion in default Linux config?
Cheers,
Vlad
Scott Cantor November 13, 2017 at 2:10 AM
Over to Rod to apply to master.
Hi,
When testing ShibSP 2.6.0 on CentOS 6, I noticed the new cipherSuites setting in ApplicationDefaults.
I tested a login via the Artifact profile - and it broke with:
After some investigation, I could reduce it to openssl (1.0.1e-48.el6_8.1, latest on CentOS 6) produces an empty cipher list with this value:
Exploring how the ciphers are listed - especially,
Kx=ECDH, I tried replacing ECDHE with ECDH (both occurrences in the list): and it worked:I've also checked on CentOS 7 - and got the same result: empty list / error for
ECDHE, non-empty forECDH:At this point, I thought I would be filing a simple bug report to fix a typo. Then I also checked on Debian (Ubuntu 16.04) - and there, both flavours worked (i.e., produced a non-empty list), but each produced a slightly different one:
When reading the documentation at https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplication, I found the reference to the Mozilla config file generator tool, but the documentation did not cover what options were passed to the generator.
My naive fix is to change ECDHE to ECDH, but as it results into a broader set of ciphers on Ubuntu, I am not sure whether this was intended.
But right now, we have a config that results into an empty set of ciphers on RedHat systems, breaking the Artifact profile.
Thanks a lot in advance for coming up with a fix.
Vlad Mencl
Research and Education Advanced Network NZ (REANNZ)