Encryption - Revision history

Jeremy: /* Secure Configuration */

2024-03-15T18:18:03Z

Secure Configuration

← Older revision		Revision as of 18:18, 15 March 2024
Line 249:		Line 249:
	===Key Creation===		===Key Creation===
	If you need a SSL/TLS cert that is signed by a root authority for public use in a web browser or other SSL/TLS client, use [https://letsencrypt.org/ Let’s Encrypt] to get free SSL certificates.<br>Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. In Public Beta 2015-12-03.		If you need a SSL/TLS cert that is signed by a root authority for public use in a web browser or other SSL/TLS client, use [https://letsencrypt.org/ Let’s Encrypt] to get free SSL certificates.<br>Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. In Public Beta 2015-12-03.
			===Adding Password===
			If for some crazy reason you end up with a key file that is not password protected ( OpenVPN client export feature of pfSense -- I'm looking at you! ), it's best to assume that key has been compromised and revoke it.<br>
			If you are certain that you want to keep that key ( e.g. it has only been written to volatile memory and can be securely erased ), you can add a password to it like so:

	==Converting==		Assuming your key file is <tt>key.private.clear.pem</tt> and you will be creating a new key file <tt>key.private.passworded.pem</tt>:
			openssl rsa -aes256 -in key.private.clear.pem -out key.private.passworded.pem
			The above command will interactively prompt you for the new key file password. I suggest you use a good random password generated from something like:
			apg -m 48 -x 48 -a 1 -n 1
			You can then shred the old cleartext key file ( this is only secure on a very limited types of filesystems like tmpfs ):
			shred -u key.private.clear.pem
			You should still make sure you keep your key file permissions minimal:
			chmod 600 key.private.passworded.pem


			===Converting===
	Before you can convert anything, you'll need to know what the various formats are.		Before you can convert anything, you'll need to know what the various formats are.
	* pem		* pem
	* der		* der
	* text		* text
	===From pem to text===		====From pem to text====
	openssl x509 -in your-cert.pem -noout -text		openssl x509 -in your-cert.pem -noout -text

	===From pem to der===		====From pem to der====
	openssl x509 -outform der -in your-cert.pem -out your-cert.crt		openssl x509 -outform der -in your-cert.pem -out your-cert.crt

Jeremy: /* Local Testing */

2023-12-16T00:20:45Z

Local Testing

@@ Line 87: / Line 87: @@
   Verify return code: 0 (ok)
   ---
 ===Server Name Indication (SNI)===

Jeremy: /* Testing */

2023-12-16T00:14:34Z

Testing

@@ Line 10: / Line 10: @@
 * [https://github.com/schubc/certbot_dns_namecheap Certbot plugin to provide dns-01 challenge support for namecheap.com]
-===Testing===
+===3rd Party Testing===
 * [https://www.ssllabs.com/ssltest/ SSL Labs SSL Tester]
 * [https://dev.ssllabs.com/ssltest/ SSL Labs SSL Tester] (Development version)
@@ Line 16: / Line 16: @@
 * [https://www.grc.com/revocation.htm Security Certificate Revocation Awareness Test]
 * [https://www.poftut.com/use-openssl-s_client-check-verify-ssltls-https-webserver/ How To Use OpenSSL s_client To Check and Verify SSL/TLS Of HTTPS Webserver]
 ===Server Name Indication (SNI)===

Jeremy: /* MACs */

2023-05-18T15:49:23Z

MACs

← Older revision		Revision as of 15:49, 18 May 2023
Line 84:		Line 84:
	* Disable anything not using -etm mode		* Disable anything not using -etm mode
	Use the following config file:<pre>MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com</pre>		Use the following config file:<pre>MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com</pre>
			Alternatively, in newer versions of OpenSSH, you can now disable specific algorithms like so:<pre># Disable known weak key exchange algorithms
			KexAlgorithms -diffie-hellman-group1-sha1

			# Disable known weak HMAC algorithms
			MACs -hmac-sha1,hmac-sha1-etm@openssh.com</pre>

	==SSL/TLS Key Management==		==SSL/TLS Key Management==

Jeremy: /* Key File Password Change */

2020-11-10T22:32:58Z

Key File Password Change

← Older revision		Revision as of 22:32, 10 November 2020
Line 69:		Line 69:

	===Key File Password Change===		===Key File Password Change===
	ssh-keygen -p existing_key_filename		ssh-keygen -p -f existing_key_filename

	=Secure Configuration=		=Secure Configuration=

Jeremy: /* SSH Key Management */

2020-09-10T09:29:55Z

SSH Key Management

← Older revision		Revision as of 09:29, 10 September 2020
Line 66:		Line 66:
	jeremy+ed25519@jbsnet.xyz.pub		jeremy+ed25519@jbsnet.xyz.pub
	</pre>		</pre>
	Older clients may not support ed25519, but fuck them.		Older clients may not support ed25519, but fuck them. Get with the program, guys.

			===Key File Password Change===
			ssh-keygen -p existing_key_filename

	=Secure Configuration=		=Secure Configuration=

Jeremy: /* HAProxy */

2020-04-08T14:39:14Z

HAProxy

← Older revision		Revision as of 14:39, 8 April 2020
Line 131:		Line 131:
	===[http://www.haproxy.org/ HAProxy]===		===[http://www.haproxy.org/ HAProxy]===
	HAProxy is free, open source software that provides a high availability load balancer and proxy server for TCP and HTTP-based applications that spreads requests across multiple servers. It is written in C and has a reputation for being fast and efficient. Mostly known/used as reverse-proxy and/or load-balancer, HAProxy makes stunnel obsolete.<br>		HAProxy is free, open source software that provides a high availability load balancer and proxy server for TCP and HTTP-based applications that spreads requests across multiple servers. It is written in C and has a reputation for being fast and efficient. Mostly known/used as reverse-proxy and/or load-balancer, HAProxy makes stunnel obsolete.<br>
			<br>
			See:
			* https://www.haproxy.com/documentation/aloha/10-0/traffic-management/lb-layer7/tls/
	<br>		<br>
	I use HAProxy to implement SNI so that I can have a single listening service on port 443 that redirects to the appropriate service depending on what DNS name is used.<br>		I use HAProxy to implement SNI so that I can have a single listening service on port 443 that redirects to the appropriate service depending on what DNS name is used.<br>

Jeremy: /* Secure SSL/TLS Ciphers */

2020-04-08T11:24:54Z

Secure SSL/TLS Ciphers

@@ Line 98: / Line 98: @@
 ==Secure SSL/TLS Ciphers==
 See https://www.owasp.org/index.php/TLS_Cipher_String_Cheat_Sheet
 ===Stunnel===
 As of 2018-07-02, using TLS <font color=red>1.3</font> with stunnel, this is the most secure configuration (TLS 1.2 and 1.3 only):
   verify = 2
   sslVersion = all
@@ Line 106: / Line 124: @@
   options = NO_TLSv1
   options = NO_TLSv1.1
   options = CIPHER_SERVER_PREFERENCE
   options = DONT_INSERT_EMPTY_FRAGMENTS
   ciphers = TLS13-AES-256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384
 ===Apache===
-As of 2018-07-02, using TLS <font color=red>1.2</font> with apache, this is the most secure configuration (TLS 1.2 only):
+===[http://www.haproxy.org/ HAProxy]===
   SSLEngine On
   SSLHonorCipherOrder On
-  SSLProtocol -ALL +TLSv1.2
+  SSLProtocol -ALL +TLSv1.3
-  SSLCipherSuite "ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-GCM-SHA256 !ECDHE-RSA-AES256-SHA384 !ECDHE-RSA-AES128-SHA256 !ECDHE-RSA-AES256-SHA !ECDHE-RSA-AES128-SHA !DHE-RSA-AES256-SHA256 !DHE-RSA-AES256-SHA !DHE-RSA-AES128-SHA256 !DHE-RSA-AES128-SHA"
+  SSLCipherSuite    TLSv1.3   TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
-  # Enable HSTS
+  # Enable Strict Transport Security (HSTS)
   Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"

Jeremy: /* Testing */

2020-04-08T10:21:58Z

Testing

← Older revision		Revision as of 10:21, 8 April 2020
Line 11:		Line 11:

	===Testing===		===Testing===
	* [https://www.ssllabs.com/ssltest/~~analyze~~.~~html?d=wiki.jeremybryansmith~~.com~~&latest~~ SSL Labs SSL Tester]		* [https://www.ssllabs.com/ssltest/ SSL Labs SSL Tester]
			* [https://dev.ssllabs.com/ssltest/ SSL Labs SSL Tester] (Development version)
			* [https://sslmate.com/caa/ DNS CAA Record Generator]
	* [https://www.grc.com/revocation.htm Security Certificate Revocation Awareness Test]		* [https://www.grc.com/revocation.htm Security Certificate Revocation Awareness Test]
	* [https://www.poftut.com/use-openssl-s_client-check-verify-ssltls-https-webserver/ How To Use OpenSSL s_client To Check and Verify SSL/TLS Of HTTPS Webserver]		* [https://www.poftut.com/use-openssl-s_client-check-verify-ssltls-https-webserver/ How To Use OpenSSL s_client To Check and Verify SSL/TLS Of HTTPS Webserver]

Jeremy: /* Free Certificates */

2020-04-01T03:38:13Z

Free Certificates

← Older revision		Revision as of 03:38, 1 April 2020
Line 8:		Line 8:
	* [https://docs.netgate.com/pfsense/en/latest/certificates/acme-package.html pfSense ACME Package]		* [https://docs.netgate.com/pfsense/en/latest/certificates/acme-package.html pfSense ACME Package]
	These days I prefer to let pfSense manage the certificate creation and renewal and use a post-renewal script to push the certificate(s) to the machines that need them.		These days I prefer to let pfSense manage the certificate creation and renewal and use a post-renewal script to push the certificate(s) to the machines that need them.
			* [https://github.com/schubc/certbot_dns_namecheap Certbot plugin to provide dns-01 challenge support for namecheap.com]

	===Testing===		===Testing===