How to disable use of TLS version 1.0

[aye-aye-aye]

Our tljh has been flagged for a few vulnerability issues in a recent Qualys scan. We'd like to disable use of TLS v1.0 and v1.1 and some legacy block ciphers.

From reading the docs, I think we have to adjust the settings in /opt/tljh/state/traefik.toml, but I can't get it to work when following the advice laid out here: https://docs.traefik.io/https/tls/#tls-options

We are using manual HTTPS with an existing self-signed key and cert as described here: http://tljh.jupyter.org/en/latest/howto/admin/https.html#manual-https-with-existing-key-and-certificate

Has anyone any advice on how to disable TLS v1.0-1, or set minimum version as v1.2?

[GeorgianaElena]

Hey @aye-aye-aye! Thanks for reporting this issue.
At the moment, the TLS version is not configurable, but your use-case makes a lot of sense and I believe we should make it configurable.

Making the TLS version configurable will require to:

• add tls options to the default config here (maybe even make TLS v1.2 be the default version)
• read the tls options from the default config and add them to the traefik.toml template
• add a test here
• document how the TLS version can be changed using tljh-config set

Would be lovely if you could make a PR 💛 I'll be here to answer any questions.

[yuvipanda]

I spent some time getting the z2jh Traefik HTTPS setup to be as good as possible, balancing secure HTTPS vs support for older clients. We should be able to just steal that code - https://github.com/jupyterhub/zero-to-jupyterhub-k8s/blob/master/jupyterhub/templates/proxy/autohttps/configmap.yaml#L65. This requires we use traefik 2.0 however...

[yuvipanda]

I don't think we need to make TLS version configurable - we should just set up for what we count as good defaults, which in this case would use TLS 1.2 and disable some older versions...

[aye-aye-aye]

Just as an FYI for anyone that may come across a similar issue, our VM team flagged us on use of an insecure cipher suite related to CVE-2016-2183 even after setting the minimum TLS version to v1.2, In our case we specified several suites in the traefik.toml config as a fix, e.g.

minVersion = "VersionTLS12"
  cipherSuites = [
    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "TLS_RSA_WITH_AES_128_GCM_SHA256",
    "TLS_RSA_WITH_AES_256_GCM_SHA384",
    "TLS_RSA_WITH_AES_128_CBC_SHA",
    "TLS_RSA_WITH_AES_256_CBC_SHA"
  ]