NethServer distro is installed with the support of weak ciphers

[alefattorini (Alessio Fattorini)]

Continuing the discussion from The NethServer server is a winner even if not perfect:

@delusion

Now some deficiencies :- NethServer distro is installed with the support of weak ciphers (supports SSLv2 and SSLv3, aNULL a MD5 hash). In my opinion, it should be at least a basic manage in the GUI. And do some post-installation steps automaticaly - generate DH2048 and set up Postfix, httpd, Squid for example to Protocol=!SSLv2 !SSLv3 and Cipher=HIGH !aNULL !MD5 and set to using the generated DH file. Then it will NethServer very good.

Snort (IPS) should see to encrypted communications. For example, this http://resources.infosecinstitute.com/ssl-decryptionThen it will be perfect NethServer.

[syntaxerrormmm (Emiliano Vavassori)]

@delusion

• NethServer distro is installed with the support of weak ciphers

I second this. Recently we had some problems with Amazon S3 servers which are not going to manage correctly the handshake phase with squid. The result is a complete failure, a website needed was not available and showed as a blank page (see here, hoping this evening to have more detailed information to update the bug report).

[robb (Rob Bosch)]

I came acrosse the same problem with other distros and I agree that disabling SSLv2 and SSLv3 is important and should be done by default since the POODLE vulnerability is a serious threat.
Disabling isn’t that hard. See https://www.centos.org/forums/viewtopic.php?f=17&t=49029

[filippo_carletti]

@robb

I came acrosse the same problem with other distros and I agree that disabling SSLv2 and SSLv3 is important

I think we already did it.
Only squid has been left out.
Could you please confirm’ Thanks.

[robb (Rob Bosch)]

Confirm… uh… I only installed a base install in a VM untill now. Need to get used to NS a bit more. If it’s fixed I think you should know…

[syntaxerrormmm (Emiliano Vavassori)]

@filippo_carletti

I think we already did it.

Also on 6.6?

@filippo_carletti

Could you please confirm

I hope to confirm this doing some tests this evening.

[filippo_carletti]

@syntaxerrormmm

Also on 6.6?

Maybe 6.6 no longer exists.
Seriously, the protocol restrictions were introduced by CentOS on 6.7, we try to follow upstream.
Going from 6.6 to 6.7 is a click on a button.
I used Qualys SSL Labs for tests.

[syntaxerrormmm (Emiliano Vavassori)]

@filippo_carletti

Going from 6.6 to 6.7 is a click on a button.

I fully understand, but do you know the old adagio “when something works, do not touch it?”
Jokes apart, we will test 6.7 but we have a “zero day” on a site using 6.6, which for the moment was worked around (disabling SSL proxying).

Will provide additional information tomorrow

[delusion]

After instaled show in postfix

When I add

show

And in squid not find default (after instalation) directive “sslproxy_cipher” and “sslproxy_options”