cipher problem after freebsd upgrade

C

cm-vdp

I upgraded our haproxy server from freebsd 11.3 to 12.0 . From that moment our client receives an ssl handshake failure while trying to connect to our application-server through the haproxy. SSL offloading happens on haproxy.
Cause: all the ciphers at client side are not enabled at our server after the upgrade.
Where do you define/enable the ciphers you want to use ? Can the cipher suite change after an upgrade ? Can I enable the old or additional ciphers and how can I do this ?

Extra info: haproxy was upgraded from 1.7 to 2.0 during the upgrade, but the config-file never changed.

Thanks, in advance.
 
I am new to freebsd. So I have still questions
How can I reinstall all packages ? After the os upgrade I ran the following commands : pkg update ; pkg upgrade.
Can I downgrade haproxy 2.0 or reinstall haproxy 1.7 ?

By the way I use poudriere as a local repository.
 
cm-vdp said:
After the os upgrade I ran the following commands : pkg update ; pkg upgrade.
Click to expand...
Ok, that should have done the right thing.

cm-vdp said:
Can I downgrade haproxy 2.0 or reinstall haproxy 1.7 ?
Click to expand...
You can switch to net/haproxy17 if you want to stay on 1.7.x. But I would recommend just fixing the issue and using the latest HAProxy version. What exactly is the issue you're having? If I recall correctly some ciphers have been removed, but those are old and shouldn't be used in any case.

I'm running 2.0.x and have this in my haproxy.conf:
Code: 
global
        ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES
:RSA+3DES:!aNULL:!MD5:!DSS
        ssl-default-bind-options no-sslv3 no-tls-tickets
{...}
frontend .... 
        bind A.A.A.A ssl crt /path/to/certs/
        
        http-response set-header Strict-Transport-Security "max-age=16000000; includeSubDomains; preload;"
        #http-response set-header X-Frame-Options DENY
        http-response set-header X-Content-Type-Options nosniff

This gives my SSL an A+ rating on various tests.
 
First, thank you for the fast support.
Our client uses ciphers they aren't enabled at our server after the upgrade. At this moment they cannot change there cipher, because this would mean new URL, certificates, and possibly firewall changes for our client. (That's what they told me) Because the connection is very important I want a temporarily workaround. So they have time to update their ciphers. So If I can solve this by reinstalling haproxy 1.7, I just do this.

The ciphers they are using:
Code: 
            Cipher Spec: SSL2_RC4_128_WITH_MD5 (0x010080)
            Cipher Spec: SSL2_IDEA_128_CBC_WITH_MD5 (0x050080)
            Cipher Spec: SSL2_DES_64_CBC_WITH_MD5 (0x060040)
            Cipher Spec: SSL2_DES_192_EDE3_CBC_WITH_MD5 (0x0700c0)
            Cipher Spec: SSL2_RC4_128_EXPORT40_WITH_MD5 (0x020080)
            Cipher Spec: SSL2_RC2_128_CBC_EXPORT40_WITH_MD5 (0x040080)
            Cipher Spec: TLS_RSA_WITH_RC4_128_MD5 (0x000004)
            Cipher Spec: TLS_RSA_WITH_RC4_128_SHA (0x000005)
            Cipher Spec: TLS_RSA_WITH_IDEA_CBC_SHA (0x000007)
            Cipher Spec: TLS_RSA_WITH_DES_CBC_SHA (0x000009)
            Cipher Spec: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x00000a)
            Cipher Spec: TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x000003)
            Cipher Spec: TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 (0x000006)
            Cipher Spec: TLS_RSA_EXPORT_WITH_DES40_CBC_SHA (0x000008)
            Cipher Spec: TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA (0x00000b)
            Cipher Spec: TLS_DH_DSS_WITH_DES_CBC_SHA (0x00000c)
            Cipher Spec: TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA (0x00000d)
            Cipher Spec: TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA (0x00000e)
            Cipher Spec: TLS_DH_RSA_WITH_DES_CBC_SHA (0x00000f)
            Cipher Spec: TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA (0x000010)
            Cipher Spec: TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA (0x000011)
            Cipher Spec: TLS_DHE_DSS_WITH_DES_CBC_SHA (0x000012)
            Cipher Spec: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x000013)
            Cipher Spec: TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA (0x000014)
            Cipher Spec: TLS_DHE_RSA_WITH_DES_CBC_SHA (0x000015)
            Cipher Spec: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x000016)
            Cipher Spec: TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 (0x000017)
            Cipher Spec: TLS_DH_anon_WITH_RC4_128_MD5 (0x000018)
            Cipher Spec: TLS_DH_anon_WITH_DES_CBC_SHA (0x00001a)
            Cipher Spec: TLS_DH_anon_WITH_3DES_EDE_CBC_SHA (0x00001b)
            Cipher Spec: TLS_RSA_WITH_NULL_MD5 (0x000001)
            Cipher Spec: TLS_RSA_WITH_NULL_SHA (0x000002)
 
So, it looks like they're using a bunch of ciphers that really shouldn't be used any more. Pretty much everything with DES, RC4, MD5 or SHA has been proven to be weak. Make sure to tell your client they should review all those.
 
You must log in or register to reply here.
Back
Top