perfSONAR User Q&A and Other Discussion

["Lang, Michael" <>]

Hello,

 

The current configuration of perfSONAR scores a grade B at Qualys SSL Labs:

 

https://www.ssllabs.com/

 

This is mostly due to no support beyond TLSv1.0 in the configuration.  This can easily be fixed by adopting the ‘intermediate’ standards from Mozilla:

 

https://wiki.mozilla.org/Security/Server_Side_TLS

 

The intermediate settings look like this for Apache:

 

SSLProtocol all -SSLv2 -SSLv3

SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"

 

One additional small tweak is to add server side cipher preference:

 

SSLHonorCipherOrder on

 

With these three changes, the configuration is upgraded to score an ‘A’, here is an example of perfSONAR running with these settings:

 

https://www.ssllabs.com/ssltest/analyze.html?d=ps1-management.net.uconn.edu

 

HTH,

 

-          Mike

 

 

Mike Lang, GCIH, GCFW

Information Security Analyst

UCONN – Information Security Office (UITS)

860-486-6816