I actually just posted that in a previous email. The only thing I cut out
were nsSSLEnabledCiphers - but here is the complete listing:

#  ldapsearch -x -D "cn=directory manager" -W -b "cn=encryption,cn=config"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <cn=encryption,cn=config> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# encryption, config
dn: cn=encryption,cn=config
objectClass: top
objectClass: nsEncryptionConfig
cn: encryption
nsSSLSessionTimeout: 0
nsSSLClientAuth: allowed
sslVersionMin: TLS1.0
nsSSL3Ciphers: +all
allowWeakCipher: off
nsSSL3: off
nsSSL2: off
nsSSLSupportedCiphers:
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD:
 :128
nsSSLSupportedCiphers:
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD:
 :256
nsSSLSupportedCiphers:
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::1
 28
nsSSLSupportedCiphers:
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::2
 56
nsSSLSupportedCiphers:
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384::AES::SHA384::2
 56
nsSSLSupportedCiphers:
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384::AES::SHA384::256
nsSSLSupportedCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA::AES::SHA1::256
nsSSLSupportedCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA::AES::SHA1::128
nsSSLSupportedCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128
nsSSLSupportedCiphers:
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256::AES::SHA256::1
 28
nsSSLSupportedCiphers:
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128
nsSSLSupportedCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256
nsSSLSupportedCiphers:
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192
nsSSLSupportedCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192
nsSSLSupportedCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA::RC4::SHA1::128
nsSSLSupportedCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA::RC4::SHA1::128
nsSSLSupportedCiphers:
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128
nsSSLSupportedCiphers:
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128
nsSSLSupportedCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128
nsSSLSupportedCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA::AES::SHA1::128
nsSSLSupportedCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128
nsSSLSupportedCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256::AES::SHA256::128
nsSSLSupportedCiphers:
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA::CAMELLIA::SHA1::
 128
nsSSLSupportedCiphers:
TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA::CAMELLIA::SHA1::
 128
nsSSLSupportedCiphers:
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256
nsSSLSupportedCiphers:
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256
nsSSLSupportedCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256
nsSSLSupportedCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA::AES::SHA1::256
nsSSLSupportedCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256::AES::SHA256::256
nsSSLSupportedCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256::AES::SHA256::256
nsSSLSupportedCiphers:
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA::CAMELLIA::SHA1::
 256
nsSSLSupportedCiphers:
TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA::CAMELLIA::SHA1::
 256
nsSSLSupportedCiphers: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192
nsSSLSupportedCiphers: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192
nsSSLSupportedCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA::RC4::SHA1::128
nsSSLSupportedCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA::AES::SHA1::128
nsSSLSupportedCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128
nsSSLSupportedCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA::AES::SHA1::256
nsSSLSupportedCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256
nsSSLSupportedCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192
nsSSLSupportedCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192
nsSSLSupportedCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA::RC4::SHA1::128
nsSSLSupportedCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA::RC4::SHA1::128
nsSSLSupportedCiphers: TLS_RSA_WITH_AES_256_GCM_SHA384::AES-GCM::SHA384::256
nsSSLSupportedCiphers: TLS_RSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128
nsSSLSupportedCiphers: TLS_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128
nsSSLSupportedCiphers: TLS_RSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128
nsSSLSupportedCiphers:
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA::CAMELLIA::SHA1::128
nsSSLSupportedCiphers: TLS_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256
nsSSLSupportedCiphers: TLS_RSA_WITH_AES_256_CBC_SHA256::AES::SHA256::256
nsSSLSupportedCiphers:
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA::CAMELLIA::SHA1::256
nsSSLSupportedCiphers: TLS_RSA_WITH_SEED_CBC_SHA::SEED::SHA1::128
nsSSLSupportedCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192
nsSSLSupportedCiphers: TLS_RSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192
nsSSLSupportedCiphers: TLS_RSA_WITH_RC4_128_SHA::RC4::SHA1::128
nsSSLSupportedCiphers: TLS_RSA_WITH_RC4_128_MD5::RC4::MD5::128
nsSSLSupportedCiphers: TLS_DHE_RSA_WITH_DES_CBC_SHA::DES::SHA1::64
nsSSLSupportedCiphers: TLS_DHE_DSS_WITH_DES_CBC_SHA::DES::SHA1::64
nsSSLSupportedCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA::DES::SHA1::64
nsSSLSupportedCiphers: TLS_RSA_WITH_DES_CBC_SHA::DES::SHA1::64
nsSSLSupportedCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA::RC4::SHA1::128
nsSSLSupportedCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA::DES::SHA1::64
nsSSLSupportedCiphers: TLS_RSA_EXPORT_WITH_RC4_40_MD5::RC4::MD5::128
nsSSLSupportedCiphers: TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5::RC2::MD5::128
nsSSLSupportedCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA::NULL::SHA1::0
nsSSLSupportedCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA::NULL::SHA1::0
nsSSLSupportedCiphers: TLS_ECDH_RSA_WITH_NULL_SHA::NULL::SHA1::0
nsSSLSupportedCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA::NULL::SHA1::0
nsSSLSupportedCiphers: TLS_RSA_WITH_NULL_SHA::NULL::SHA1::0
nsSSLSupportedCiphers: TLS_RSA_WITH_NULL_SHA256::NULL::SHA256::0
nsSSLSupportedCiphers: TLS_RSA_WITH_NULL_MD5::NULL::MD5::0
nsSSLSupportedCiphers: SSL_CK_RC4_128_WITH_MD5::RC4::MD5::128
nsSSLSupportedCiphers: SSL_CK_RC2_128_CBC_WITH_MD5::RC2::MD5::128
nsSSLSupportedCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5::3DES::MD5::192
nsSSLSupportedCiphers: SSL_CK_DES_64_CBC_WITH_MD5::DES::MD5::64
nsSSLSupportedCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5::RC4::MD5::128
nsSSLSupportedCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5::RC2::MD5::128
nssslenabledciphers:
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::1
 28
nssslenabledciphers:
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::2
 56
nssslenabledciphers:
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128
nssslenabledciphers:
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256
nssslenabledciphers:
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384::AES::SHA384::256
nssslenabledciphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384::AES::SHA384::256
nssslenabledciphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA::AES::SHA1::256
nssslenabledciphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA::AES::SHA1::128
nssslenabledciphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128
nssslenabledciphers:
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128
nssslenabledciphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128
nssslenabledciphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256
nssslenabledciphers: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128
nssslenabledciphers: TLS_DHE_DSS_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128
nssslenabledciphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128
nssslenabledciphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA::AES::SHA1::128
nssslenabledciphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128
nssslenabledciphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256::AES::SHA256::128
nssslenabledciphers:
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA::CAMELLIA::SHA1::12
 8
nssslenabledciphers:
TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA::CAMELLIA::SHA1::12
 8
nssslenabledciphers: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256
nssslenabledciphers: TLS_DHE_DSS_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256
nssslenabledciphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256
nssslenabledciphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA::AES::SHA1::256
nssslenabledciphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256::AES::SHA256::256
nssslenabledciphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256::AES::SHA256::256
nssslenabledciphers:
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA::CAMELLIA::SHA1::25
 6
nssslenabledciphers:
TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA::CAMELLIA::SHA1::25
 6
nssslenabledciphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA::AES::SHA1::128
nssslenabledciphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128
nssslenabledciphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA::AES::SHA1::256
nssslenabledciphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256
nssslenabledciphers: TLS_RSA_WITH_AES_256_GCM_SHA384::AES-GCM::SHA384::256
nssslenabledciphers: TLS_RSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128
nssslenabledciphers: TLS_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128
nssslenabledciphers: TLS_RSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128
nssslenabledciphers: TLS_RSA_WITH_CAMELLIA_128_CBC_SHA::CAMELLIA::SHA1::128
nssslenabledciphers: TLS_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256
nssslenabledciphers: TLS_RSA_WITH_AES_256_CBC_SHA256::AES::SHA256::256
nssslenabledciphers: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA::CAMELLIA::SHA1::256
nssslenabledciphers: TLS_RSA_WITH_SEED_CBC_SHA::SEED::SHA1::128
nsTLS1: on
sslVersionMax: TLS1.2

# RSA, encryption, config
dn: cn=RSA,cn=encryption,cn=config
objectClass: top
objectClass: nsEncryptionModule
nsSSLPersonalitySSL: Server-Cert
nsSSLActivation: on
cn: RSA
nsSSLToken: internal (software)

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2


On Wed, Sep 23, 2015 at 11:53 AM, Martin Kosek <mko...@redhat.com> wrote:

> On 09/23/2015 05:05 PM, Michael Lasevich wrote:
>
>> Yes, I am talking about 389ds as is integrated in FreeIPA (would be silly
>> to
>> post completely non-IPA questions to this list...).
>>
>
> You would not be the first to do it :-)
>
> I am running FreeIPA 4.1.4 on CentOS 7.1 and RC4 is enabled on port 636 no
>> matter what I do.
>>
>> I am running "CentOS Linux release 7.1.1503 (Core)"
>>
>> Relevant Packages:
>>
>> freeipa-server-4.1.4-1.el7.centos.x86_64
>> 389-ds-base-1.3.3.8-1.el7.centos.x86_64
>> nss-3.19.1-5.el7_1.x86_64
>> openssl-1.0.1e-42.el7.9.x86_64
>>
>> LDAP setting (confirmed that in error.log there is no menition of RC4 in
>> list
>> of ciphers):
>>
>> nsSSL3Ciphers:
>>
>> -rc4,-rc4export,-rc2,-rc2export,-des,-desede3,-rsa_rc4_128_md5,-rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,+rsa_fips_3des_sha,+fips_3des_sha,-rsa_fips_des_sha,-fips_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,-tls_rsa_export1024_with_rc4_56_sha,-rsa_rc4_56_sha,-tls_rsa_export1024_with_des_cbc_sha,-rsa_des_56_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-dhe_dss_des_sha,+dhe_dss_3des_sha,-dhe_rsa_des_sha,+dhe_rsa_3des_sha,+tls_rsa_aes_128_sha,+rsa_aes_128_sha,+tls_dhe_dss_aes_128_sha,+tls_dhe_rsa_aes_128_sha,+tls_rsa_aes_256_sha,+rsa_aes_256_sha,+tls_dhe_dss_aes_256_sha,+tls_dhe_rsa_aes_256_sha,-tls_dhe_dss_1024_rc4_sha,-tls_dhe_dss_rc4_128_sha
>>
>
> Something is really strange here. We need to see settings in
> "cn=encryption,cn=config" to investigate further.
>
> $ ldapsearch -h ipa.example.com -b cn=encryption,cn=config -D
> "cn=Directory Manager" -x -W
>
> should be a good start to give this information. nsSSL3Ciphers for example
> should be set to "+all" and "allowWeakCipher" to off, as per
>
> http://fedorahosted.org/freeipa/ticket/4395
>
> Slapd "error" log showing no ciphersuites supporting RC4:
>>
>> [23/Sep/2015:08:51:04 -0600] SSL Initialization - Configured SSL version
>> range:
>> min: TLS1.0, max: TLS1.2
>> [23/Sep/2015:08:51:04 -0600] - SSL alert: Cipher suite fortezza is not
>> available in NSS 3.16.  Ignoring fortezza
>> [23/Sep/2015:08:51:04 -0600] - SSL alert: Cipher suite
>> fortezza_rc4_128_sha is
>> not available in NSS 3.16.  Ignoring fortezza_rc4_128_sha
>> [23/Sep/2015:08:51:04 -0600] - SSL alert: Cipher suite fortezza_null is
>> not
>> available in NSS 3.16.  Ignoring fortezza_null
>> [23/Sep/2015:08:51:04 -0600] - SSL alert: Configured NSS Ciphers
>> [23/Sep/2015:08:51:04 -0600] - SSL alert:
>> TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled
>> [23/Sep/2015:08:51:04 -0600] - SSL alert:
>> TLS_DHE_DSS_WITH_AES_128_CBC_SHA: enabled
>> [23/Sep/2015:08:51:04 -0600] - SSL alert:
>> TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled
>> [23/Sep/2015:08:51:04 -0600] - SSL alert:
>> TLS_DHE_DSS_WITH_AES_256_CBC_SHA: enabled
>> [23/Sep/2015:08:51:04 -0600] - SSL alert:
>>  TLS_RSA_WITH_AES_128_CBC_SHA:
>> enabled
>> [23/Sep/2015:08:51:04 -0600] - SSL alert:
>>  TLS_RSA_WITH_AES_256_CBC_SHA:
>> enabled
>> [23/Sep/2015:08:51:04 -0600] - 389-Directory/1.3.3.8 <http://1.3.3.8>
>>
>> B2015.040.128 starting up
>>
>>
>> But sslscan returns:
>>
>> $ sslscan --no-failed localhost:636
>> ...
>>
>> Supported Server Cipher(s):
>>
>>      Accepted  TLSv1  256 bits  AES256-SHA
>>      Accepted  TLSv1  128 bits  AES128-SHA
>>      Accepted  TLSv1  128 bits  DES-CBC3-SHA
>>      Accepted  TLSv1  128 bits  RC4-SHA
>>      Accepted  TLSv1  128 bits  RC4-MD5
>>      Accepted  TLS11  256 bits  AES256-SHA
>>      Accepted  TLS11  128 bits  AES128-SHA
>>      Accepted  TLS11  128 bits  DES-CBC3-SHA
>>      Accepted  TLS11  128 bits  RC4-SHA
>>      Accepted  TLS11  128 bits  RC4-MD5
>>      Accepted  TLS12  256 bits  AES256-SHA256
>>      Accepted  TLS12  256 bits  AES256-SHA
>>      Accepted  TLS12  128 bits  AES128-GCM-SHA256
>>      Accepted  TLS12  128 bits  AES128-SHA256
>>      Accepted  TLS12  128 bits  AES128-SHA
>>      Accepted  TLS12  128 bits  DES-CBC3-SHA
>>      Accepted  TLS12  128 bits  RC4-SHA
>>      Accepted  TLS12  128 bits  RC4-MD5
>>
>> ...
>>
>>
>> I would assume the sslscan is broken, but nmap and other scanners all
>> confirm
>> that RC4 is still on.
>>
>> -M
>>
>>
>> On Wed, Sep 23, 2015 at 3:35 AM, Martin Kosek <mko...@redhat.com
>> <mailto:mko...@redhat.com>> wrote:
>>
>>     On 09/23/2015 11:00 AM, Michael Lasevich wrote:
>>      > OK, this is most bizarre issue,
>>      >
>>      > I am trying to disable RC4 based TLS Cipher Suites in LDAPs(port
>> 636) and
>>      > for the life of me cannot get it to work
>>      >
>>      > I have followed many nearly identical instructions to create ldif
>> file and
>>      > change "nsSSL3Ciphers" in "cn=encryption,cn=config". Seems simple
>> enough -
>>      > and I get it to take, and during the startup I can see the right
>> SSL Cipher
>>      > Suites listed in errors.log - but when it starts and I probe it,
>> RC4
>>      > ciphers are still there. I am completely confused.
>>      >
>>      > I tried setting "nsSSL3Ciphers" to "default" (which does not have
>> "RC4")
>>      > and to old style cyphers lists(lowercase), and new style cypher
>>      > lists(uppercase), and nothing seems to make any difference.
>>      >
>>      > Any ideas?
>>      >
>>      > -M
>>
>>     Are you asking about standalone 389-DS or the one integrated in
>> FreeIPA? As
>>     with currently supported versions of FreeIPA, RC4 ciphers should be
>> already
>>     gone, AFAIK.
>>
>>     In RHEL/CentOS world, it should be fixed in 6.7/7.1 or later:
>>
>>     https://bugzilla.redhat.com/show_bug.cgi?id=1154687
>>     https://fedorahosted.org/freeipa/ticket/4653
>>
>>
>>
>
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to