<html><body>Hi Rob, I stopped IPA, modified dse.ldif, restarted with the cipher list and it started without issue however Same 13 ciphers. You know.. thinking about this now.. I going to try something. The box I am testing on it a replica master and not the first replica. I did not think this would make a difference since I removed the replica from the realm before testing but maybe it will not change anything thinking its stuck in the old realm? Starting Nmap 5.51 ( <a href="http://nmap.org/">http://nmap.org</a> ) at 2016-04-29 11:51 EDT Nmap scan report for Host is up (0.000082s latency). PORT STATE SERVICE 636/tcp open ldapssl | ssl-enum-ciphers: | TLSv1.2 | Ciphers (13) | SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA | SSL_RSA_FIPS_WITH_DES_CBC_SHA | TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA | TLS_RSA_EXPORT1024_WITH_RC4_56_SHA | TLS_RSA_WITH_3DES_EDE_CBC_SHA | TLS_RSA_WITH_AES_128_CBC_SHA | TLS_RSA_WITH_AES_128_CBC_SHA256 | TLS_RSA_WITH_AES_128_GCM_SHA256 | TLS_RSA_WITH_AES_256_CBC_SHA | TLS_RSA_WITH_AES_256_CBC_SHA256 | TLS_RSA_WITH_DES_CBC_SHA | TLS_RSA_WITH_RC4_128_MD5 | TLS_RSA_WITH_RC4_128_SHA | Compressors (1) dn: cn=encryption,cn=config objectClass: top objectClass: nsEncryptionConfig cn: encryption nsSSLSessionTimeout: 0 nsSSLClientAuth: allowed nsSSL2: off nsSSL3: off creatorsName: cn=server,cn=plugins,cn=config modifiersName: cn=directory manager createTimestamp: 20150420131850Z modifyTimestamp: 20150420131906Z nsSSL3Ciphers: -rsa_null_md5,-rsa_rc4_128_sha,-rsa_rc4_128_md5,-rsa_rc4_40_md5 ,-rsa_rc2_40_md5,-rsa_des_sha,-rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_ sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-tls_rsa_export1024_with_r c4_56_sha,-tls_rsa_export1024_with_des_cbc_sha numSubordinates: 1 Sean Hogan Security Engineer Watson Security & Risk Assurance Watson Cloud Technology and Support email: schogan@us.ibm.com | Tel 919 486 1397 <img src="cid:1__=88BBF537DFC49CA78f9e8a93df938690918c88B@" width="67" height="53" align="top"> <img src="cid:2__=88BBF537DFC49CA78f9e8a93df938690918c88B@" width="60" height="51" align="top"> <img width="16" height="16" src="cid:3__=88BBF537DFC49CA78f9e8a93df938690918c88B@" border="0" alt="Inactive hide details for Rob Crittenden ---04/29/2016 08:30:29 AM---Sean Hogan wrote: > Hi Noriko,">Rob Crittenden ---04/29/2016 08:30:29 AM---Sean Hogan wrote: > Hi Noriko, From: Rob Crittenden <rcritten@redhat.com> To: Sean Hogan/Durham/IBM@IBMUS, Noriko Hosoi <nhosoi@redhat.com> Cc: freeipa-users@redhat.com Date: 04/29/2016 08:30 AM Subject: Re: [Freeipa-users] IPA vulnerability management SSL <hr width="100%" size="2" align="left" noshade style="color:#8091A5; "> <tt>Sean Hogan wrote: > Hi Noriko, > > Thanks for the suggestions, > > I had to trim out the GCM ciphers in order to get IPA to start back up > or I would get the unknown cipher message The trick is getting the cipher name right (it doesn't always follow a pattern) and explicitly disabling some ciphers as they are enabled by default. Try this string: -rsa_null_md5,-rsa_rc4_128_sha,-rsa_rc4_128_md5,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_des_sha,-rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-tls_rsa_export1024_with_rc4_56_sha,-tls_rsa_export1024_with_des_cbc_sha I have an oldish install but I think it will still do what you need: 389-ds-base-1.2.11.15-68.el6_7.x86_64 Starting Nmap 7.12 ( </tt><tt><a href="https://nmap.org">https://nmap.org</a></tt><tt> ) at 2016-04-29 11:24 EDT Nmap scan report for pacer.example.com (192.168.126.2) Host is up (0.00053s latency). PORT STATE SERVICE 636/tcp open ldapssl | ssl-enum-ciphers: | TLSv1.2: | ciphers: | TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A | TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A | TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A | SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C | TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C | compressors: | NULL | cipher preference: server |_ least strength: C Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds $ sslscan pacer.example.com:636 |grep Accept Accepted TLSv1 256 bits AES256-SHA Accepted TLSv1 128 bits AES128-SHA Accepted TLSv1 112 bits DES-CBC3-SHA Accepted TLS11 256 bits AES256-SHA Accepted TLS11 128 bits AES128-SHA Accepted TLS11 112 bits DES-CBC3-SHA Accepted TLS12 256 bits AES256-SHA256 Accepted TLS12 256 bits AES256-SHA Accepted TLS12 128 bits AES128-GCM-SHA256 Accepted TLS12 128 bits AES128-SHA256 Accepted TLS12 128 bits AES128-SHA Accepted TLS12 112 bits DES-CBC3-SHA rob > > Nmap is still showing the same 13 ciphers as before though like nothing > had changed and I did ipactl stop, made modification, ipactl start > > tarting Nmap 5.51 ( </tt><tt><a href="http://nmap.org">http://nmap.org</a></tt><tt> <</tt><tt><a href="http://nmap.org/">http://nmap.org/</a></tt><tt>> ) at 2016-04-28 > 18:44 EDT > Nmap scan report for > Host is up (0.000053s latency). > PORT STATE SERVICE > 636/tcp open ldapssl > | ssl-enum-ciphers: > | TLSv1.2 > | Ciphers (13) > | SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA > | SSL_RSA_FIPS_WITH_DES_CBC_SHA > | TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA > | TLS_RSA_EXPORT1024_WITH_RC4_56_SHA > | TLS_RSA_WITH_3DES_EDE_CBC_SHA > | TLS_RSA_WITH_AES_128_CBC_SHA > | TLS_RSA_WITH_AES_128_CBC_SHA256 > | TLS_RSA_WITH_AES_128_GCM_SHA256 > | TLS_RSA_WITH_AES_256_CBC_SHA > | TLS_RSA_WITH_AES_256_CBC_SHA256 > | TLS_RSA_WITH_DES_CBC_SHA > | TLS_RSA_WITH_RC4_128_MD5 > | TLS_RSA_WITH_RC4_128_SHA > | Compressors (1) > |_ uncompressed > > Nmap done: 1 IP address (1 host up) scanned in 0.21 seconds > > Current Config: > > dse.ldif > dn: cn=encryption,cn=config > objectClass: top > objectClass: nsEncryptionConfig > cn: encryption > nsSSLSessionTimeout: 0 > nsSSLClientAuth: allowed > nsSSL2: off > nsSSL3: off > creatorsName: cn=server,cn=plugins,cn=config > modifiersName: cn=directory manager > createTimestamp: 20150420131850Z > modifyTimestamp: 20150420131906Z > nsSSL3Ciphers: > -rsa_null_md5,-rsa_null_sha,-rsa_null_sha,-rsa_rc4_56_sha,-tls_ > rsa_export1024_with_rc4_56_sha,-tls_dhe_dss_1024_rc4_sha,+tls_rsa_aes_128_sha > ,+rsa_aes_128_sha,+tls_dhe_dss_aes_128_sha,+tls_dhe_rsa_aes_128_sha,+tls_rsa_ > aes_256_sha,+rsa_aes_256_sha > numSubordinates: 1 > > > nss.conf > # SSL 3 ciphers. SSL 2 is disabled by default. > NSSCipherSuite > -rsa_null_md5,-rsa_null_sha,-rsa_null_sha,-rsa_rc4_56_sha,-tls_rsa_export1024_with_rc4_56_sha,-tls_dhe_dss_1024_rc4_sha,+tls_rsa_aes_128_sha,+rsa_aes_128_sha,+tls_dhe_dss_aes_128_sha,+tls_dhe_rsa_aes_128_sha,+tls_rsa_aes_256_sha,+rsa_aes_256_sha,+tls_rsa_aes_128_gcm_sha,+tls_dhe_rsa_aes_128_gcm_sha,+tls_dhe_dss_aes_128_gcm_sha > > NSSProtocol TLSv1.0,TLSv1.1,TLSv1.2 > > > Does nss.conf have anything to do with the dir srv ciphers? I know the > 389 docs says they are tied together so the way I have been looking at > it is nss.conf lists the allowed ciphers where dse.ldif lists which ones > to use for 389 from nss.conf. Is that correct? Is there any other place > where ciphers would be ignored? > > nss-3.19.1-8.el6_7.x86_64 > sssd-ipa-1.12.4-47.el6_7.4.x86_64 > ipa-client-3.0.0-47.el6_7.1.x86_64 > ipa-server-selinux-3.0.0-47.el6_7.1.x86_64 > ipa-pki-common-theme-9.0.3-7.el6.noarch > ipa-python-3.0.0-47.el6_7.1.x86_64 > ipa-server-3.0.0-47.el6_7.1.x86_64 > libipa_hbac-python-1.12.4-47.el6_7.4.x86_64 > ipa-admintools-3.0.0-47.el6_7.1.x86_64 > ipa-pki-ca-theme-9.0.3-7.el6.noarch > 389-ds-base-1.2.11.15-68.el6_7.x86_64 > 389-ds-base-libs-1.2.11.15-68.el6_7.x86_64 > > > I need to get rid of any rc4s > > Sean Hogan > Security Engineer > Watson Security & Risk Assurance > Watson Cloud Technology and Support > email: schogan@us.ibm.com | Tel 919 486 1397 > > > > > > > Inactive hide details for Noriko Hosoi ---04/28/2016 12:08:59 PM---Thank > you for including me in the loop, Ludwig. On 04/28/201Noriko Hosoi > ---04/28/2016 12:08:59 PM---Thank you for including me in the loop, > Ludwig. On 04/28/2016 04:34 AM, Ludwig Krispenz wrote: > > From: Noriko Hosoi <nhosoi@redhat.com> > To: Ludwig Krispenz <lkrispen@redhat.com>, freeipa-users@redhat.com > Date: 04/28/2016 12:08 PM > Subject: Re: [Freeipa-users] IPA vulnerability management SSL > Sent by: freeipa-users-bounces@redhat.com > > ------------------------------------------------------------------------ > > > > Thank you for including me in the loop, Ludwig. > > On 04/28/2016 04:34 AM, Ludwig Krispenz wrote: > > If I remember correctly we did the change in default ciphers and the > option for handling in 389-ds > 1.3.3, so it would not be in RHEL6, > adding Noriko to get confirmation. > > Ludwig is right. The way how to set nsSSL3Ciphers has been changed > since 1.3.3 which is available on RHEL-7. > > This is one of the newly supported values of nsSSL3Ciphers: > > Notes: if the value contains +all, then *-<cipher>*is removed > from the list._ > __http://www.port389.org/docs/389ds/design/nss-cipher-design.html#available-by-setting-all----nss-3162-1_ > > On the older 389-ds-base including 389-ds-base-1.2.11.X on RHEL-6.X, if > "+all" is found in the value, all the available ciphers are enabled. > > To workaround it, could you try explicitely setting ciphers as follows? > nsSSL3Ciphers: > -rsa_null_md5,-rsa_null_sha,-rsa_null_sha,-rsa_rc4_56_sha,-tls_rsa_export1024_with_rc4_56_sha,-tls_dhe_dss_1024_rc4_sha, > +tls_rsa_aes_128_sha,+rsa_aes_128_sha,+tls_dhe_dss_aes_128_sha,+tls_dhe_rsa_aes_128_sha,+tls_rsa_aes_256_sha,+rsa_aes_256_sha, > +tls_rsa_aes_128_gcm_sha,+tls_dhe_rsa_aes_128_gcm_sha,+tls_dhe_dss_aes_128_gcm_sha > > Thanks, > --noriko > > On 04/28/2016 04:34 AM, Ludwig Krispenz wrote: > > wanted to add Noriko, but hit send to quickly > > On 04/28/2016 01:26 PM, Ludwig Krispenz wrote: > > On 04/28/2016 12:06 PM, Martin Kosek wrote: > On 04/28/2016 01:23 AM, Sean Hogan wrote: > Hi Martin, > > No joy on placing - in front of the RC4s > > > I modified my nss.conf to now read > # SSL 3 ciphers. SSL 2 is disabled by > default. > NSSCipherSuite > +aes_128_sha_256,+aes_256_sha_256,+ecdhe_ecdsa_aes_128_gcm_sha_256,+ecdhe_ecdsa_aes_128_sha,+ecdhe_ecdsa_aes_256_sha,+ecdhe_rsa_aes_128_gcm_sha_256,+ecdhe_rsa_aes_128_sha,+ecdhe_rsa_aes_256_sha,+rsa_aes_128_gcm_sha_256,+rsa_aes_128_sha,+rsa_aes_256_sha > > > # SSL Protocol: > # Cryptographic protocols that provide > communication security. > # NSS handles the specified protocols as > "ranges", and automatically > # negotiates the use of the strongest > protocol for a connection starting > # with the maximum specified protocol > and downgrading as necessary to the > # minimum specified protocol that can be > used between two processes. > # Since all protocol ranges are > completely inclusive, and no protocol in > the > NSSProtocol TLSv1.0,TLSv1.1,TLSv1.2 > > dse.ldif > > dn: cn=encryption,cn=config > objectClass: top > objectClass: nsEncryptionConfig > cn: encryption > nsSSLSessionTimeout: 0 > nsSSLClientAuth: allowed > nsSSL2: off > nsSSL3: off > creatorsName: > cn=server,cn=plugins,cn=config > modifiersName: cn=directory manager > createTimestamp: 20150420131850Z > modifyTimestamp: 20150420131906Z > nsSSL3Ciphers: > +all,-rsa_null_sha,-rsa_rc4_56_sha,-tls_rsa_export1024_with_rc4 > > _56_sha,-tls_dhe_dss_1024_rc4_sha > numSubordinates: 1 > > > > But I still get this with nmap.. I > thought the above would remove > -tls_rsa_export1024_with_rc4_56_sha but > still showing. Is it the fact that I am not > offering > -tls_rsa_export1024_with_rc4_56_sha? If > so.. not really understanding > where it is coming from cept the +all > from DS but the - should be negating that? > > Starting Nmap 5.51 ( _http://nmap.org_ > <</tt><tt><a href="http://nmap.org/">http://nmap.org/</a></tt><tt>>_<</tt><tt><a href="http://nmap.org/">http://nmap.org/</a></tt><tt>>_ > <</tt><tt><a href="http://nmap.org/">http://nmap.org/</a></tt><tt>>) at 2016-04-27 17:37 EDT > Nmap scan report for > Host is up (0.000086s latency). > PORT STATE SERVICE > 636/tcp open ldapssl > | ssl-enum-ciphers: > | TLSv1.2 > | Ciphers (13) > | SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA > | SSL_RSA_FIPS_WITH_DES_CBC_SHA > | TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA > | TLS_RSA_EXPORT1024_WITH_RC4_56_SHA > | TLS_RSA_WITH_3DES_EDE_CBC_SHA > | TLS_RSA_WITH_AES_128_CBC_SHA > | TLS_RSA_WITH_AES_128_CBC_SHA256 > | TLS_RSA_WITH_AES_128_GCM_SHA256 > | TLS_RSA_WITH_AES_256_CBC_SHA > | TLS_RSA_WITH_AES_256_CBC_SHA256 > | TLS_RSA_WITH_DES_CBC_SHA > | TLS_RSA_WITH_RC4_128_MD5 > | TLS_RSA_WITH_RC4_128_SHA > | Compressors (1) > |_ uncompressed > > Nmap done: 1 IP address (1 host up) > scanned in 0.32 seconds > > > > It seems no matter what config I put > into nss.conf or dse.ldif nothing changes > with my nmap results. Is there supposed > to be a be a section to add TLS ciphers > instead of SSL Not sure now, CCing Ludwig who was involved in > the original RHEL-6 > implementation. If I remember correctly we did the change in default > ciphers and the option for handling in 389-ds > 1.3.3, > so it would not be in RHEL6, adding Noriko to get > confirmation. > > but the below comments about changing ciphers in > dse.ldif could help in using the "old" way to set ciphers > Just to be sure, when you are modifying > dse.ldif, the procedure > should be always following: > > 1) Stop Directory Server service > 2) Modify dse.ldif > 3) Start Directory Server service > > Otherwise it won't get applied and will get > overwritten later. > > In any case, the ciphers with RHEL-6 should be > secure enough, the ones in > FreeIPA 4.3.1 should be even better. This is for > example an nmap taken on > FreeIPA Demo instance that runs on FreeIPA 4.3.1: > > $ nmap --script ssl-enum-ciphers -p 636 > ipa.demo1.freeipa.org > > Starting Nmap 7.12 ( _https://nmap.org_ > <</tt><tt><a href="https://nmap.org/">https://nmap.org/</a></tt><tt>>) at 2016-04-28 12:02 CEST > Nmap scan report for ipa.demo1.freeipa.org > (209.132.178.99) > Host is up (0.18s latency). > PORT STATE SERVICE > 636/tcp open ldapssl > | ssl-enum-ciphers: > | TLSv1.2: > | ciphers: > | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 > (secp256r1) - A > | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA > (secp256r1) - A > | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 > (secp256r1) - A > | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA > (secp256r1) - A > | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh > 2048) - A > | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh > 2048) - A > | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh > 2048) - A > | TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh > 2048) - A > | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh > 2048) - A > | TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa > 2048) - A > | TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A > | TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa > 2048) - A > | TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A > | TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa > 2048) - A > | compressors: > | NULL > | cipher preference: server > |_ least strength: A > > Nmap done: 1 IP address (1 host up) scanned in > 21.12 seconds > > Martin > > -- > Manage your subscription for the Freeipa-users mailing list: > </tt><tt><a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></tt><tt> > Go to </tt><tt><a href="http://freeipa.org">http://freeipa.org</a></tt><tt> for more info on the project > > > > </tt> </body></html>