<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 10/15/14, 1:07 PM, Shawn Wells
wrote:<br>
</div>
<blockquote cite="mid:543EA9E1.1050103@redhat.com" type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<div class="moz-cite-prefix">On 10/15/14, 10:17 AM, Jan Lieskovsky
wrote:<br>
</div>
<blockquote
cite="mid:1808715386.40055651.1413382654106.JavaMail.zimbra@redhat.com"
type="cite">
<pre wrap="">Hello folks,
in relation to the recent SSLv3 CVE-2014-3566 / "POODLE" flaw:
[1] <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://fedoramagazine.org/what-you-need-to-know-about-the-sslv3-poodle-flaw-cve-2014-3566/">http://fedoramagazine.org/what-you-need-to-know-about-the-sslv3-poodle-flaw-cve-2014-3566/</a>
got wondering if there's anything SSG should do to react against it.
Possibly to add / update system service rules checking for system SSL
version that it is higher than SSLv3? [1] suggest httpd would be
one candidate, but I am sure there would be more of them. Should this be
investigated further & particular rules updated?
Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
P.S.: For those possibly wondering the proposal is not to add rule checking
particular package version is >= than the updated version disabling
use of SSLv3 (IOW not to perform the CVE check itself). But rather
check configuration of possibly affected system services, if they
aren't using SSLv3 via their configuration files (since setting
default SSL version higher than SSLv3 is one thing, but actually
checking if that version isn't enabled again [by administrator] an another one).</pre>
</blockquote>
<br>
<br>
Already reflect using TLS for SMTP:<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-guide-custom.html#postfix_server_mail_relay_require_tls_for_smtp_auth">http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-guide-custom.html#postfix_server_mail_relay_require_tls_for_smtp_auth</a><br>
<br>
And using TLS for LDAP:<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-guide-custom.html#ldap_client_start_tls">http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-guide-custom.html#ldap_client_start_tls</a><br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-guide-custom.html#ldap_client_tls_cacertpath">http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-guide-custom.html#ldap_client_tls_cacertpath</a><br>
<br>
And using TLS for SSL:<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-guide-custom.html#network_ssl">http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-guide-custom.html#network_ssl</a><br>
<br>
And then specifically calls out using FIPS 140-2 certified
ciphers, which means the system forces protocols of TLSv1.1 and
TLSv1.0 and disables all other ciphers but the FIPS ones:<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-guide-custom.html#sshd_use_approved_ciphers">http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-guide-custom.html#sshd_use_approved_ciphers</a><br>
<br>
<br>
Big RHT has published some guidance for services such as Tomcat,
Firefox/Chrome, and httpd here:<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://access.redhat.com/articles/1232123">https://access.redhat.com/articles/1232123</a><br>
<br>
Pulling in the guidance for Apache makes sense... something like<br>
<meta charset="utf-8">
<blockquote type="cite">
<meta charset="utf-8">
<p style="font-size: 13px; border: 0px; margin: 6px 0px 12px;
padding: 0px; vertical-align: baseline; color: rgb(51, 51,
51); font-family: 'Liberation Sans', 'Trebuchet MS',
'Bitstream Vera Sans', helvetica, verdana, arial, sans-serif;
font-style: normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; line-height: 18.2000007629395px;
orphans: auto; text-align: left; text-indent: 0px;
text-transform: none; white-space: normal; widows: auto;
word-spacing: 0px; -webkit-text-stroke-width: 0px; background:
rgb(255, 255, 255);">set the SSLProtocol directive as follows
in /etc/httpd/conf.d/ssl.conf:</p>
<strong>D</strong><strong style="font-size: 13px; border: 0px;
margin: 0px; padding: 0px; vertical-align: baseline;
background: transparent;">isable everything except TLSv1.x</strong>
<p style="font-size: 13px; border: 0px; margin: 6px 0px 12px;
padding: 0px; vertical-align: baseline; color: rgb(51, 51,
51); font-family: 'Liberation Sans', 'Trebuchet MS',
'Bitstream Vera Sans', helvetica, verdana, arial, sans-serif;
font-style: normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; line-height: 18.2000007629395px;
orphans: auto; text-align: left; text-indent: 0px;
text-transform: none; white-space: normal; widows: auto;
word-spacing: 0px; -webkit-text-stroke-width: 0px; background:
rgb(255, 255, 255);">On RHEL 7 or RHEL 6.6 and later:</p>
<pre style="font-size: 13px; border-width: 1px 1px 1px 2px; border-style: solid; border-color: rgb(238, 238, 238) rgb(238, 238, 238) rgb(238, 238, 238) rgb(204, 204, 204); margin: 10px 20px; padding: 10px; vertical-align: baseline; font-family: 'Liberation Sans', 'Luxi Sans', 'Trebuchet MS', 'Bitstream Vera Sans', helvetica, verdana, arial, sans-serif; white-space: pre; overflow-x: auto; width: auto; word-wrap: normal; color: rgb(51, 51, 51); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 18.2000007629395px; orphans: auto; text-align: left; text-indent: 0px; text-transform: none; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background: repeat white;"><code style="font-size: 11px; border: 0px; margin: 0px; padding: 0px; vertical-align: baseline; overflow-x: auto; white-space: pre; width: auto; word-wrap: normal; background: transparent;"> SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2</code></pre>
</blockquote>
</blockquote>
<br>
<br>
Just double checked the JBoss EAP guidance, has TLS written in:<br>
<br>
"
<meta charset="utf-8">
<span style="color: rgb(120, 31, 28); font-family: Geneva, Arial,
Helvetica, sans-serif; font-size: 14px; font-style: italic;
font-variant: normal; font-weight: bold; letter-spacing: normal;
line-height: normal; orphans: auto; text-align: start;
text-indent: 0px; text-transform: none; white-space: normal;
widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;
display: inline !important; float: none;">2.14 -<span
class="Apple-converted-space"> </span></span><a
name="rule_xccdf_com.redhat.eap5.scap_rule_4005" style="color:
rgb(204, 0, 0); font-family: Geneva, Arial, Helvetica, sans-serif;
font-size: 14px; font-style: italic; font-variant: normal;
font-weight: bold; letter-spacing: normal; line-height: normal;
orphans: auto; text-align: start; text-indent: 0px;
text-transform: none; white-space: normal; widows: auto;
word-spacing: 0px; -webkit-text-stroke-width: 0px;">Ensure
applications deployed by JBoss present valid DoD certificates
where applicable</a>"<br>
<a class="moz-txt-link-freetext" href="http://people.redhat.com/swells/scap-security-guide/JBossEAP5/docs/JBossEAP5_Guide.html#rule_xccdf_com.redhat.eap5.scap_rule_4005">http://people.redhat.com/swells/scap-security-guide/JBossEAP5/docs/JBossEAP5_Guide.html#rule_xccdf_com.redhat.eap5.scap_rule_4005</a><br>
<br>
"
<meta charset="utf-8">
<span class="itemHead" style="font-weight: bold; font-style: italic;
color: rgb(120, 31, 28); font-family: Geneva, Arial, Helvetica,
sans-serif; font-size: 14px; font-variant: normal; letter-spacing:
normal; line-height: normal; orphans: auto; text-align: start;
text-indent: 0px; text-transform: none; white-space: normal;
widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">2.17
-<span class="Apple-converted-space"> </span><a
name="rule_xccdf_com.redhat.eap5.scap_rule_4008" style="color:
rgb(204, 0, 0);">Enable Federal Information and Processing
Systems 140-2 (FIPS) compliant cryptographic modules for use by
JBoss Java environment</a></span>"<br>
<a class="moz-txt-link-freetext" href="http://people.redhat.com/swells/scap-security-guide/JBossEAP5/docs/JBossEAP5_Guide.html#rule_xccdf_com.redhat.eap5.scap_rule_4008">http://people.redhat.com/swells/scap-security-guide/JBossEAP5/docs/JBossEAP5_Guide.html#rule_xccdf_com.redhat.eap5.scap_rule_4008</a>
<meta charset="utf-8">
<br>
<br>
"
<meta charset="utf-8">
<span style="color: rgb(120, 31, 28); font-family: Geneva, Arial,
Helvetica, sans-serif; font-size: 14px; font-style: italic;
font-variant: normal; font-weight: bold; letter-spacing: normal;
line-height: normal; orphans: auto; text-align: start;
text-indent: 0px; text-transform: none; white-space: normal;
widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;
display: inline !important; float: none;">5.5 -<span
class="Apple-converted-space"> </span></span><a
name="rule_xccdf_com.redhat.eap5.scap_rule_1094" style="color:
rgb(204, 0, 0); font-family: Geneva, Arial, Helvetica, sans-serif;
font-size: 14px; font-style: italic; font-variant: normal;
font-weight: bold; letter-spacing: normal; line-height: normal;
orphans: auto; text-align: start; text-indent: 0px;
text-transform: none; white-space: normal; widows: auto;
word-spacing: 0px; -webkit-text-stroke-width: 0px;">Do not
transmit sensitive information over unsecured HTTP connections</a>"<br>
<a class="moz-txt-link-freetext" href="http://people.redhat.com/swells/scap-security-guide/JBossEAP5/docs/JBossEAP5_Guide.html#rule_xccdf_com.redhat.eap5.scap_rule_1094">http://people.redhat.com/swells/scap-security-guide/JBossEAP5/docs/JBossEAP5_Guide.html#rule_xccdf_com.redhat.eap5.scap_rule_1094</a><br>
<br>
<br>
</body>
</html>