You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ambari.apache.org by "Robert Levas (JIRA)" <ji...@apache.org> on 2018/01/22 18:38:00 UTC
[jira] [Comment Edited] (AMBARI-20545) Remove the use of legacy SSL
and TLS protocol versions
[ https://issues.apache.org/jira/browse/AMBARI-20545?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16334649#comment-16334649 ]
Robert Levas edited comment on AMBARI-20545 at 1/22/18 6:37 PM:
----------------------------------------------------------------
[~lars_francke], [~jonathan.hurley]...
So we should set the following by default in the ambari.properties file:
{code:java}
security.server.disabled.protocols=SSL|SSLv2|SSLv3
{code}
This should take care of the issue at hand. If we agree, I can test to make sure this actually works (I am about -99.9-100% positive it should) and create the patch.
UPDATE: I just tested it. After allowing SSL via the {{java.security}} file, I was able to turn on and off the SSL* protocols via {{security.server.disabled.protocols}} in the {{ambari.properties}}.
was (Author: rlevas):
[~lars_francke], [~jonathan.hurley]...
So we should set the following by default in the ambari.properties file:
{code:java}
security.server.disabled.protocols=SSL|SSLv2|SSLv3
{code}
This should take care of the issue at hand. If we agree, I can test to make sure this actually works (I am about 99.9% positive it should) and create the patch.
> Remove the use of legacy SSL and TLS protocol versions
> ------------------------------------------------------
>
> Key: AMBARI-20545
> URL: https://issues.apache.org/jira/browse/AMBARI-20545
> Project: Ambari
> Issue Type: Bug
> Components: ambari-server, security
> Affects Versions: 2.4.2
> Reporter: Andy LoPresto
> Assignee: Robert Levas
> Priority: Major
> Labels: security, ssl, tls
> Fix For: trunk
>
>
> I notice that the explicit enabling of various protocols still includes SSLv2Hello and SSLv3, which are severely broken protocols with numerous known vulnerabilities and not necessary for legacy compatibility. Even TLSv1 and TLSv1.1 have been [discouraged since February 2014|https://community.qualys.com/thread/12421], when all modern browsers supported TLSv1.2. Is there any reason Ambari still needs to enable support for these legacy protocols, and are there any other mitigating controls put in place to prevent downgrade, brute force, padding oracle, and weak parameter attacks against these protocols? Thanks.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)