You probably want to disable SSLv3 on the admin server too. Add the
following line to /etc/dirsrv/admin-serv/console.conf:
NSSProtocol TLSv1.0,TLSv1.1
Documentation here:
https://git.fedorahosted.org/cgit/mod_nss.git/plain/docs/mod_nss.html
Regarding the directory server, I didn't find "nsTLS1" under
cn=encryption,cn=config,
It is not in dse.ldif by default, but if you do an ldapsearch you should
see it. It is on by default which is why it worked.
The recommendation is to
ldapmodify -x -D "cn=directory manager" -w 'password' <<EOF
dn: cn=encryption,cn=config
changetype: modify
replace: nsSSL3
nsSSL3: off
-
replace: nsTLS1
nsTLS1: on
-
EOF
Then restart dirsrv
but setting "nsSSL3: off" did the trick, the
openldap command line tools, the 389ds-console and sssd still works. (We
have "nsslapd-minssf: 128" in cn=config).
You can test like this:
openssl s_client -connect hostname:389 -ssl3
openssl s_client -connect hostname:636 -ssl3
openssl s_client -connect hostname:9830 -ssl3
If the above commands says something like:
140183413589832:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong
version number:s3_pkt.c:337:
New, (NONE), Cipher is (NONE)
Then SSLv3 is disabled.
If the s_client output looks like this:
New, TLSv1/SSLv3, Cipher is AES128-SHA
and it's waiting for input, then SSLv3 is enabled!
Have a nice day,
Paul
On 2014-10-15 20:20, Rich Megginson wrote:
> On 10/15/2014 12:34 PM, Michael Gettes wrote:
>> Hi David (et al),
>>
>> what is the right way to do this in the DS? (i am on 1.2.11.32)
>>
>> i see under cn=config there is cn=encryption and there are
>> nsSSL3Ciphers and nsSSLSupportCiphers (lots of these). The
>> documentation just shows the simple on/off for SSL/TLS.
>
https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/9....
> and
>
https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/9....
> and
>
https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/9....
> and
>
https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/9....
> and
>
https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/9....
>
> You might be able to just set nsSSL2: off and nsSSL3: off and nsTLS1: on
>> For me, my admin server has SSL on but it is behind a firewall so I am
>> not concerned with adjusting it.
>>
>> Thanks for pointers.
>>
>> /mrg
>>
>> On Oct 15, 2014, at 12:12 PM, David Boreham <david_list(a)boreham.org
>> <mailto:david_list@boreham.org>> wrote:
>>
>>> On 10/15/2014 8:16 AM, Jan Tomasek wrote:
>>>> is
http://poodlebleed.com/ related to 389? I think it is, this is
>>>> not implementation flaw in OpenSSL, this seems to be related to the
>>>> SSLv3 design.
>>> From
>>>
http://askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poo...
>>> :
>>>
>>>
>>> Is it relevant for HTTPS only or also for IMAP/SMTP/OpenVPN and
>>> other protocols with SSL support?
>>>
>>> The current attack vector as shown by the researchers works with
>>> controlling the plaintext sent to the server using Javascript being
>>> run on the victim's machine. This vector does not apply to non-HTTPS
>>> scenarios without using a browser.
>>>
>>> Also, normally an SSL client doesn't allow the session to be
>>> downgraded to SSLv3 (having TLSv1+ seen in the handshake
>>> capabilities), but browsers want to be very backward compatible and
>>> the do. The combination with controlling plaintext and the specific
>>> way a HTTP header is built up makes it exploitable.
>>>
>>> Conclusion: disable SSLv3 for HTTPS *now*, disable SSLv3 for other
>>> services in your next service window.
>>>
>>>
>>>
>>> --
>>> 389 users mailing list
>>> 389-users(a)lists.fedoraproject.org
>>> <mailto:389-users@lists.fedoraproject.org>
>>>
https://admin.fedoraproject.org/mailman/listinfo/389-users
>>
>>
>> --
>> 389 users mailing list
>> 389-users(a)lists.fedoraproject.org
>>
https://admin.fedoraproject.org/mailman/listinfo/389-users
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users