honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove TLS 1.0 as a default SSL protocol (#37512) 

The default value for ssl.supported_protocols no longer includes TLSv1
as this is an old protocol with known security issues.
Administrators can enable TLSv1.0 support by configuring the
appropriate `ssl.supported_protocols` setting, for example:

xpack.security.http.ssl.supported_protocols: ["TLSv1.2","TLSv1.1","TLSv1"]

Relates: #36021
This commit is contained in:
Tim Vernum 2019-01-25 15:46:39 +11:00 committed by GitHub
parent 6a13a252e9
commit 03690d12b2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 24 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
docs/reference/migration/migrate_7_0/settings.asciidoc
View File

@ -132,6 +132,19 @@ fallback to a default configuration when using TLS. Each component (realm, trans
http client, etc) must now be configured with their own settings for TLS if it is being
used.
[float]
[[tls-v1-removed]]
==== TLS v1.0 disabled
TLS version 1.0 is now disabled by default as it suffers from
https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet#Rule_-_Only_Support_Strong_Protocols[known security issues].
The default protocols are now TLSv1.2 and TLSv1.1.
You can enable TLS v1.0 by configuring the relevant `ssl.supported_protocols` setting to include `"TLSv1"`, for example:
[source,yaml]
--------------------------------------------------
xpack.security.http.ssl.supported_protocols: [ "TLSv1.2", "TLSv1.1", "TLSv1" ]
--------------------------------------------------
[float]
[[watcher-notifications-account-settings]]
==== Watcher notifications account settings

7
docs/reference/settings/security-settings.asciidoc
View File

@ -480,7 +480,7 @@ and `full`. Defaults to `full`.
See <<ssl-tls-settings,`ssl.verification_mode`>> for an explanation of these values.
`ssl.supported_protocols`::
Supported protocols for TLS/SSL (with versions). Defaults to `TLSv1.2,TLSv1.1,TLSv1`.
Supported protocols for TLS/SSL (with versions). Defaults to `TLSv1.2,TLSv1.1`.
`ssl.cipher_suites`:: Specifies the cipher suites that should be supported when
communicating with the LDAP server.
@ -724,7 +724,7 @@ and `full`. Defaults to `full`.
See <<ssl-tls-settings,`ssl.verification_mode`>> for an explanation of these values.
`ssl.supported_protocols`::
Supported protocols for TLS/SSL (with versions). Defaults to `TLSv1.2, TLSv1.1, TLSv1`.
Supported protocols for TLS/SSL (with versions). Defaults to `TLSv1.2, TLSv1.1`.
`ssl.cipher_suites`:: Specifies the cipher suites that should be supported when
communicating with the Active Directory server.
@ -1206,8 +1206,7 @@ settings. For more information, see
`ssl.supported_protocols`::
Supported protocols with versions. Valid protocols: `SSLv2Hello`,
`SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`. Defaults to `TLSv1.2`, `TLSv1.1`,
`TLSv1`.
`SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`. Defaults to `TLSv1.2`, `TLSv1.1`.
+
--
NOTE: If `xpack.security.fips_mode.enabled` is `true`, you cannot use `SSLv2Hello`

4
docs/reference/settings/ssl-settings.asciidoc
View File

@ -11,8 +11,8 @@ endif::server[]
+{ssl-prefix}.ssl.supported_protocols+::
Supported protocols with versions. Valid protocols: `SSLv2Hello`,
`SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`. Defaults to `TLSv1.2`, `TLSv1.1`,
`TLSv1`.
`SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`. Defaults to `TLSv1.2`, `TLSv1.1`.
ifdef::server[]
+{ssl-prefix}.ssl.client_authentication+::

2
libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java
View File

@ -68,7 +68,7 @@ import static org.elasticsearch.common.ssl.SslConfigurationKeys.VERIFICATION_MOD
*/
public abstract class SslConfigurationLoader {
static final List<String> DEFAULT_PROTOCOLS = Arrays.asList("TLSv1.2", "TLSv1.1", "TLSv1");
static final List<String> DEFAULT_PROTOCOLS = Arrays.asList("TLSv1.2", "TLSv1.1");
static final List<String> DEFAULT_CIPHERS = loadDefaultCiphers();
private static final char[] EMPTY_PASSWORD = new char[0];

2
x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/XPackSettings.java
View File

@ -154,7 +154,7 @@ public class XPackSettings {
}
}, Setting.Property.NodeScope);
public static final List<String> DEFAULT_SUPPORTED_PROTOCOLS = Arrays.asList("TLSv1.2", "TLSv1.1", "TLSv1");
public static final List<String> DEFAULT_SUPPORTED_PROTOCOLS = Arrays.asList("TLSv1.2", "TLSv1.1");
public static final SSLClientAuth CLIENT_AUTH_DEFAULT = SSLClientAuth.REQUIRED;
public static final SSLClientAuth HTTP_CLIENT_AUTH_DEFAULT = SSLClientAuth.NONE;
public static final VerificationMode VERIFICATION_MODE_DEFAULT = VerificationMode.FULL;

4
x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ssl/SSLConfigurationTests.java
View File

@ -11,6 +11,7 @@ import org.elasticsearch.common.settings.Settings;
import org.elasticsearch.env.Environment;
import org.elasticsearch.env.TestEnvironment;
import org.elasticsearch.test.ESTestCase;
import org.elasticsearch.xpack.core.XPackSettings;
import org.elasticsearch.xpack.core.ssl.TrustConfig.CombiningTrustConfig;
import javax.net.ssl.KeyManager;
@ -22,6 +23,7 @@ import java.util.Arrays;
import static org.hamcrest.Matchers.equalTo;
import static org.hamcrest.Matchers.everyItem;
import static org.hamcrest.Matchers.hasItem;
import static org.hamcrest.Matchers.instanceOf;
import static org.hamcrest.Matchers.is;
import static org.hamcrest.Matchers.isIn;
@ -35,6 +37,8 @@ public class SSLConfigurationTests extends ESTestCase {
assertThat(globalConfig.keyConfig(), sameInstance(KeyConfig.NONE));
assertThat(globalConfig.trustConfig(), is(not((globalConfig.keyConfig()))));
assertThat(globalConfig.trustConfig(), instanceOf(DefaultJDKTrustConfig.class));
assertThat(globalConfig.supportedProtocols(), equalTo(XPackSettings.DEFAULT_SUPPORTED_PROTOCOLS));
assertThat(globalConfig.supportedProtocols(), not(hasItem("TLSv1")));
}
public void testThatOnlyKeystoreInSettingsSetsTruststoreSettings() {