Commits on Oct 3, 2023

1. mgr/dashboard: allow tls 1.2 with a config option …

   Provide the option to allow tls1.2
   
   `ceph dashboard set-enable-unsafe-tls-v1-2 True` followed with a mgr
   restart will enable tls 1.2.
   
   With tls1.2 enabled
   ```
   ╰─$ nmap -sV --script ssl-enum-ciphers -p 11000 127.0.0.1
   Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-27 16:56 IST
   Nmap scan report for localhost (127.0.0.1)
   Host is up (0.00018s latency).
   
   PORT      STATE SERVICE  VERSION
   11000/tcp open  ssl/http CherryPy wsgiserver
   |_http-server-header: Ceph-Dashboard
   | ssl-enum-ciphers:
   |   TLSv1.2:
   |     ciphers:
   |       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
   |       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
   |       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
   |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519) - A
   |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
   |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
   |       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
   |       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A
   |       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
   |       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A
   |       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
   |       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
   |       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
   |       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
   |     compressors:
   |       NULL
   |     cipher preference: server
   |   TLSv1.3:
   |     ciphers:
   |       TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
   |       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
   |       TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
   |       TLS_AKE_WITH_AES_128_CCM_SHA256 (ecdh_x25519) - A
   |     cipher preference: server
   |_  least strength: A
   
   Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
   Nmap done: 1 IP address (1 host up) scanned in 16.55 seconds
   ```
   
   Without tls1.2 enabled (which defaults to tls 1.3)
   ```
   ╰─$ nmap -sV --script ssl-enum-ciphers -p 11000 127.0.0.1
   Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-27 16:54 IST
   Nmap scan report for localhost (127.0.0.1)
   Host is up (0.000075s latency).
   
   PORT      STATE SERVICE  VERSION
   11000/tcp open  ssl/http CherryPy wsgiserver
   | ssl-enum-ciphers:
   |   TLSv1.3:
   |     ciphers:
   |       TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
   |       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
   |       TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
   |       TLS_AKE_WITH_AES_128_CCM_SHA256 (ecdh_x25519) - A
   |     cipher preference: server
   |_  least strength: A
   |_http-server-header: Ceph-Dashboard
   ```
   
   Fixes: https://tracker.ceph.com/issues/62940
   Signed-off-by: Nizamudeen A <nia@redhat.com>
   (cherry picked from commit 219c62b)

   

   nizamial09 committed Oct 3, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for cfe4a6e
   • Browse repository at this point

   Copy the full SHA

   cfe4a6e View commit details

   Browse the repository at this point in the history