You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by jl...@apache.org on 2017/12/16 13:46:35 UTC
svn commit: r1818402 -
/ofbiz/ofbiz-framework/trunk/framework/catalina/ofbiz-component.xml
Author: jleroux
Date: Sat Dec 16 13:46:35 2017
New Revision: 1818402
URL: http://svn.apache.org/viewvc?rev=1818402&view=rev
Log:
Fixed: Prevent the possible return of the Robot attack
(OFBIZ-10085)
After reading https://robotattack.org/ and testing
https://robotattack.org/check/?h=demo-trunk.ofbiz.apache.org which returned
(same for stable and old)
This host is not vulnerable.
However it still allows connections with the problematic RSA encryption
ciphers.
I concluded that we should remove RSA encryption ciphers from our Tomcat config.
See https://tomcat.apache.org/tomcat-8.5-doc/config/http.html
This removes RSA from ciphers and also sslProtocol which is now TLS by default
Modified:
ofbiz/ofbiz-framework/trunk/framework/catalina/ofbiz-component.xml
Modified: ofbiz/ofbiz-framework/trunk/framework/catalina/ofbiz-component.xml
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/framework/catalina/ofbiz-component.xml?rev=1818402&r1=1818401&r2=1818402&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/framework/catalina/ofbiz-component.xml (original)
+++ ofbiz/ofbiz-framework/trunk/framework/catalina/ofbiz-component.xml Sat Dec 16 13:46:35 2017
@@ -147,8 +147,7 @@ under the License.
<property name="keystoreType" value="JKS"/>
<property name="keyAlias" value="ofbiz"/>
<property name="keyPass" value="changeit"/>
- <property name="sslProtocol" value="TLS"/>
- <property name="ciphers" value=""/>
+ <property name="ciphers" value="HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5"/>
</property>
</container>
<container name="catalina-container-test" loaders="test" class="org.apache.ofbiz.catalina.container.CatalinaContainer">
@@ -207,8 +206,7 @@ under the License.
<property name="keystoreFile" value="framework/base/config/ofbizssl.jks"/>
<property name="keystorePass" value="changeit"/>
<property name="keystoreType" value="JKS"/>
- <property name="sslProtocol" value="TLS"/>
- <property name="ciphers" value=""/>
+ <property name="ciphers" value="HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5"/>
</property>
</container>
<!--