也不使用 SSL v3 及 TLSv1.0協定
考古題
昨天同事問我如何關閉 Apache RC4 加密演算法,
所以順便整理這個小筆記,供需要的人參考.
網路常用的RC4加密演算法已可快速破解，研究人員呼籲別再使用
http://www.ithome.com.tw/news/97445
Google 發現 SSL 3.0 漏洞，小心「貴賓犬」攻擊！
http://www.ithome.com.tw/news/91571
TLS加密協定竟然也不安全！企業須審慎內部漏洞
http://www.ithome.com.tw/promotion/93094
懶人包..--> 不使用不安全的加密演算法及通訊協定
#vi /etc/httpd/conf.d/ssl.conf ( Cenots 6 / httpd 2.2 預設檔案位置 )
原 SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
使用 nmap RC4 檢測結果為
[root@bbb conf.d]# nmap --script ssl-cert,ssl-enum-ciphers -p 443 127.0.0.1 | grep RC4
| TLS_ECDHE_RSA_WITH_RC4_128_SHA
| TLS_RSA_WITH_RC4_128_MD5
| TLS_RSA_WITH_RC4_128_SHA
| TLS_ECDHE_RSA_WITH_RC4_128_SHA
| TLS_RSA_WITH_RC4_128_MD5
| TLS_RSA_WITH_RC4_128_SHA
| TLS_ECDHE_RSA_WITH_RC4_128_SHA
| TLS_RSA_WITH_RC4_128_MD5
| TLS_RSA_WITH_RC4_128_SHA
| TLS_ECDHE_RSA_WITH_RC4_128_SHA
| TLS_RSA_WITH_RC4_128_MD5
| TLS_RSA_WITH_RC4_128_SHA
中獎-->使用 RC4....
===========
改為
SSLHonorCipherOrder on
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
再檢測即可看到: 已無 RC4 加密演算法
[root@bbb conf.d]# nmap --script ssl-cert,ssl-enum-ciphers -p 443 127.0.0.1 | grep RC4
再看一次該主機的 ssl 資訊 , 可發現有使用不安全的 SSLv3 的協定
[root@bbb conf.d]# nmap --script ssl-cert,ssl-enum-ciphers -p 443 127.0.0.1
Starting Nmap 5.51 ( http://nmap.org ) at 2016-10-19 15:48 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000027s latency).
PORT STATE SERVICE
443/tcp open https
| ssl-cert: Subject: commonName=aaa/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Issuer: commonName=aaa/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Public Key type: rsa
| Public Key bits: 2048
| Not valid before: 2015-04-08 02:58:19
| Not valid after: 2016-04-07 02:58:19
| MD5: de0e fdf1 11c0 f3e4 2cc2 3b0b 8e9e 6b9a
|_SHA-1: fc10 b6c3 b1e8 695c 19f4 78a2 3e5d 58f6 6a69 a9f5
| ssl-enum-ciphers:
| SSLv3
| Ciphers (2)
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
| Compressors (1)
| uncompressed
| TLSv1.0
| Ciphers (2)
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
| Compressors (1)
| uncompressed
| TLSv1.1
| Ciphers (2)
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
| Compressors (1)
| uncompressed
| TLSv1.2
| Ciphers (8)
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
| Compressors (1)
|_ uncompressed
Nmap done: 1 IP address (1 host up) scanned in 0.38 seconds
但還是中獎 --> 使用 SSLv3 + TLSv1.0
==============
所以再次 vi 該檔案 ssl.conf , 將它改為下面這樣的宣告僅使用 TLS 協定方式.
#SSLProtocol all -SSLv2
SSLProtocol -all +TLSv1.1 +TLSv1.2
再次驗證,已無使用 SSLv3 及 TLSv1 ...
[root@bbb conf.d]# nmap --script ssl-cert,ssl-enum-ciphers -p 443 127.0.0.1
Starting Nmap 5.51 ( http://nmap.org ) at 2016-10-19 16:10 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000028s latency).
PORT STATE SERVICE
443/tcp open https
| ssl-cert: Subject: commonName=aaa/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Issuer: commonName=aaa/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Public Key type: rsa
| Public Key bits: 2048
| Not valid before: 2015-04-08 02:58:19
| Not valid after: 2016-04-07 02:58:19
| MD5: de0e fdf1 11c0 f3e4 2cc2 3b0b 8e9e 6b9a
|_SHA-1: fc10 b6c3 b1e8 695c 19f4 78a2 3e5d 58f6 6a69 a9f5
| ssl-enum-ciphers:
| TLSv1.1
| Ciphers (2)
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
| Compressors (1)
| uncompressed
| TLSv1.2
| Ciphers (8)
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
| Compressors (1)
|_ uncompressed
Nmap done: 1 IP address (1 host up) scanned in 0.35 seconds
這樣應該好多了....可以弱點掃描或滲透測試的軟體去試看看...是否還有其它的問題???
參考資訊
https://raymii.org/s/tutorials/Strong_SSL_Security_On_Apache2.html
https://www.owasp.org/index.php/Testing_for_Weak_SSL/TLS_Ciphers,_Insufficient_Transport_Layer_Protection_(OTG-CRYPST-001)
http://serverfault.com/questions/314858/how-to-enable-tls-1-1-and-1-2-with-openssl-and-apache
外部 FQDN 檢測網站
https://www.ssllabs.com/ssltest
沒有留言:
張貼留言