TLS policy and ejabberd

[stephdl]

Ejabberd after the update is not hardened by the tls-policy we implemented, I propose to make it possible.

I followed this tutorial https://blog.process-one.net/securing-ejabberd-with-tls-encryption/ and for now I modified

• c2s on port 5222
• s2s on port 5269
• for these port I added a new option relative to tls_compression.
• new ciphers, only compatible to tls1.2 (compatible to our TLS-policy 20180621)

I saw that we could make also a dh key to enhance the security, for now I did nothing, maybe it could be a NFR.

[DavidePrincipi]

I think we need a new policy identifier, because we actually upgrade the ejabberd configuration from a "default" one to a newly defined (more restrictive) one. Like 2018-10-01

Why to allow only TLS 1.2? Can we allow also TLS 1.1?

[stephdl]

Why to allow only TLS 1.2? Can we allow also TLS 1.1?

you are right, I checked the documentation (tlspolicy page) and I saw now that sslV3 and tlsv1 is removed, but in the comment code I read that only tls1.2 is allowed....it is my mistake

Probably the doc should be adjusted because I Tested with testssl.sh and of course tls1.0/1.1 is still allowed.

Honestly I do not think we need another policy name, except if we want to protect other services by a new list of really secure ciphers....But we could enhance the security of ejabberd when the tlspolicy is not default

[DavidePrincipi]

Note that docs section is about "slapd"!

I'm assuming the server is at "upstream default" setup: if now the ejabberd clients can use SSL3 or TLS < 1.2 we must define a new policy identifier and require an explicit policy upgrade. Othewise there is a (theoretical at least) risk of cutting them out.

It's fine that a policy actually affects just one service, like ejabberd, which has some dedicated TCP ports and protocols.

[DavidePrincipi]

Remember the docs! ;)

• add policy 2018-10-01 documentation

[nethbot]

in 7.5.1804/testing:

• nethserver-base-3.4.4-1.1.gedbf2e4.ns7.noarch.rpm

[stephdl]

@DavidePrincipi please review the documentation NethServer/docs#364

[DavidePrincipi]

@stephdl, I added some changes: please review them (I cannot set you as reviewer of your PR)

[nethbot]

in 7.5.1804/testing:

• nethserver-ejabberd-1.2.0-1.1.gb68cb1a.ns7.noarch.rpm

[nethbot]

in 7.5.1804/testing:

• nethserver-ejabberd-1.2.0-1.2.g2354efe.ns7.noarch.rpm

[nethbot]

in 7.5.1804/testing:

• nethserver-ejabberd-1.2.0-1.3.gb3facf4.ns7.noarch.rpm

[DavidePrincipi]

Test case 0

After RPM update, an existing system must preserve the previous available cipher suite

Test case 1

Upgrade to TLS policy 20181001: only TLS 1.2 is available from ejabberd service

---

QA note: as STARTTLS method seems not working with nmap, test TLS-wrap connection on port 5223

[DavidePrincipi]

@stephdl, did you verify the S2S socket?

The C2S is VERIFIED for me

[stephdl]

For me, even our previous configuration has an issue, we ought to prove what cipher you used even with nmap, testssl or https://xmpp.net/

Check https://community.nethserver.org/t/starttls-and-ejabberd/10800

Something is wrong.... Sure we could test the 5223 and accept it could be right for the 5222 (starttls) but I do not understand what it occurs

Let me try https://xmpp.net/ with the port 5269

[nethbot]

in 7.5.1804/testing:

• nethserver-base-3.4.4-1.3.gb971e8c.ns7.noarch.rpm

[stephdl]

Let me try https://xmpp.net/ with the port 5269

from this https://xmpp.net/result.php?id=826718, S2S is well secured by the new policy 20181001

from this https://xmpp.net/result.php?id=826747 , S2S get the default cipher configuration with older policy

the s2s is verified @DavidePrincipi

[nethbot]

in 7.5.1804/testing:

• nethserver-ejabberd-1.2.0-1.4.gfc79598.ns7.noarch.rpm

[stephdl]

QA

Ciphers list compatible with https://bettercrypto.org/static/applied-crypto-hardening.pdf and the tlspolicy20180621 we implemented (ECC compatible)

this time we harden

web admin interface 5280
c2s 5222,5223
s2s 5269

to test 5280,5223 (without starttls)
nmap --script ssl-enum-ciphers conference.de-labrusse.fr -p 5223
nmap --script ssl-enum-ciphers conference.de-labrusse.fr -p 5280

for s2s and c2s (starttls) , please use https://xmpp.net/index.php

• s2s (5269) you must use conference.domain.org or pubsub.domain.org
• c2s (5222) you must use domain.org (relevant to your ejabberd domain))

[stephdl]

Remember the docs! ;)

• add policy 2018-10-01 documentation

[nethbot]

in 7.5.1804/testing:

• nethserver-ejabberd-1.2.0-1.5.g687b603.ns7.noarch.rpm

[DavidePrincipi]

VERIFIED

See my comment here NethServer/nethserver-ejabberd#16 (comment)

[nethbot]

in 7.5.1804/updates:

• nethserver-base-3.5.0-1.ns7.noarch.rpm

[nethbot]

in 7.5.1804/updates:

• nethserver-ejabberd-1.3.0-1.ns7.noarch.rpm