Welcome! Log In Create A New Profile

Advanced

Re: [PATCH] Disable Anonymous ECDH ciphersuites by default

António P. P. Almeida
June 14, 2011 08:06AM
On 14 Jun 2011 09h58 WEST, rob.stradling@comodo.com wrote:




> !ADH to exclude the Anonymous DH ciphersuites. With OpenSSL-0.x,
> this has the effect of disabling all ciphersuites that offer no
> authentication. However, OpenSSL-1.x adds support for Anonymous
> ECDH ciphersuites, and these are not disabled by !ADH.
>
> !aNULL is the appropriate cipher string for disabling all anonymous
> ciphersuites. [1] observes that anonymous ciphersuites 'are
> vulnerable to a "man in the middle'' attack and so their use is
> normally discouraged.'
>
> Trivial patch attached.
>
> Apache httpd just committed a patch for the same issue [2].
>
> [1] http://www.openssl.org/docs/apps/ciphers.html
> [2] https://issues.apache.org/bugzilla/show_bug.cgi?id=51363
>
> Rob Stradling Senior Research & Development Scientist COMODO -
> Creating Trust Online [2 disable_aecdh.patch <text/x-patch; UTF-8
> (7bit)>] diff -ur nginx-1.0.4/conf/nginx.conf
> nginx-1.0.4-defaultcipher/conf/nginx.conf
> --- nginx-1.0.4/conf/nginx.conf 2009-04-06 14:43:46.000000000 +0100
> +++ nginx-1.0.4-defaultcipher/conf/nginx.conf 2011-06-14 09:36:25.250146709 +0100
> @@ -106,7 +106,7 @@
> # ssl_session_timeout 5m;
>
> # ssl_protocols SSLv2 SSLv3 TLSv1;
> - # ssl_ciphers
> # ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
> + # ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
> # ssl_prefer_server_ciphers on;
>
> # location / {
> diff -ur nginx-1.0.4/src/http/modules/ngx_http_ssl_module.c
> nginx-1.0.4-defaultcipher/src/http/modules/ngx_http_ssl_module.c
> --- nginx-1.0.4/src/http/modules/ngx_http_ssl_module.c 2010-05-14 10:56:37.000000000 +0100
> +++ nginx-1.0.4-defaultcipher/src/http/modules/ngx_http_ssl_module.c 2011-06-14 09:33:42.085994902 +0100
> @@ -13,7 +13,7 @@
> ngx_pool_t *pool, ngx_str_t *s);
>
>
> -#define NGX_DEFAULT_CIPHERS "HIGH:!ADH:!MD5"
> +#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
>
>
> static ngx_int_t ngx_http_ssl_static_variable(ngx_http_request_t *r,


Shouldn't there be some sort of check for the OpenSSH version?

#if OPENSSL_VERSION_NUMBER >= 0x100000000

(after 1.x code)

#else

(before 1.x code)

#endif

If I understood correctly this is something that appeared in 1.x. not
existing in 0.9.x.

Is it so?

--- appa

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://nginx.org/mailman/listinfo/nginx-devel
Subject Author Views Posted

[PATCH] Disable Anonymous ECDH ciphersuites by default

Rob Stradling 6266 June 14, 2011 05:02AM

Re: [PATCH] Disable Anonymous ECDH ciphersuites by default

António P. P. Almeida 1463 June 14, 2011 08:06AM

Re: [PATCH] Disable Anonymous ECDH ciphersuites by default

Rob Stradling 1413 June 14, 2011 08:20AM

Re: [PATCH] Disable Anonymous ECDH ciphersuites by default

Maxim Dounin 1459 June 14, 2011 04:48PM

Re: [PATCH] Disable Anonymous ECDH ciphersuites by default Attachments

António P. P. Almeida 1984 June 17, 2011 02:46PM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 206
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 500 on July 15, 2024
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready