From 071e746c45b976d0866da454068c645ccd8dfcc4 Mon Sep 17 00:00:00 2001 From: Dan Callahan Date: Thu, 23 Mar 2017 14:17:46 -0500 Subject: [PATCH 1/7] Update the default cipher suite This is the Modern preset from: https://mozilla.github.io/server-side-tls/ssl-config-generator/ --- plugins/nginx-vhosts/install | 7 +++++-- plugins/nginx-vhosts/templates/nginx.conf.sigil | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install index 8b4d53217..97d206c2e 100755 --- a/plugins/nginx-vhosts/install +++ b/plugins/nginx-vhosts/install @@ -33,10 +33,13 @@ include $DOKKU_ROOT/*/nginx.conf; server_tokens off; +# Settings from https://mozilla.github.io/server-side-tls/ssl-config-generator/ ssl_session_cache shared:SSL:20m; -ssl_session_timeout 10m; +ssl_session_timeout 1d; +ssl_protocols TLSv1.2; +ssl_prefer_server_ciphers on; -ssl_ciphers EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5; +ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'; EOF fi diff --git a/plugins/nginx-vhosts/templates/nginx.conf.sigil b/plugins/nginx-vhosts/templates/nginx.conf.sigil index 6638afe37..d1c6bb468 100644 --- a/plugins/nginx-vhosts/templates/nginx.conf.sigil +++ b/plugins/nginx-vhosts/templates/nginx.conf.sigil @@ -47,7 +47,7 @@ server { ssl_certificate {{ $.APP_SSL_PATH }}/server.crt; ssl_certificate_key {{ $.APP_SSL_PATH }}/server.key; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_protocols TLSv1.2; keepalive_timeout 70; {{ if eq $.SPDY_SUPPORTED "true" }}add_header Alternate-Protocol {{ $.NGINX_SSL_PORT }}:npn-spdy/2;{{ end }} From 3fab90109755303d69c3d11fc78243f58cd15cda Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 20 Apr 2017 20:13:44 -0600 Subject: [PATCH 2/7] fix: drop duplicate config values [ci skip] --- plugins/nginx-vhosts/install | 2 -- 1 file changed, 2 deletions(-) diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install index 97d206c2e..abf9bf7b7 100755 --- a/plugins/nginx-vhosts/install +++ b/plugins/nginx-vhosts/install @@ -36,8 +36,6 @@ server_tokens off; # Settings from https://mozilla.github.io/server-side-tls/ssl-config-generator/ ssl_session_cache shared:SSL:20m; ssl_session_timeout 1d; -ssl_protocols TLSv1.2; -ssl_prefer_server_ciphers on; ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'; From 4abad29b3acf621c2958efdf48ae23ebbdb44239 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 20 Apr 2017 20:14:10 -0600 Subject: [PATCH 3/7] feat: set prefer_server_ciphers to on by default [ci skip] --- plugins/nginx-vhosts/templates/nginx.conf.sigil | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/nginx-vhosts/templates/nginx.conf.sigil b/plugins/nginx-vhosts/templates/nginx.conf.sigil index d1c6bb468..cfc537377 100644 --- a/plugins/nginx-vhosts/templates/nginx.conf.sigil +++ b/plugins/nginx-vhosts/templates/nginx.conf.sigil @@ -48,6 +48,7 @@ server { ssl_certificate {{ $.APP_SSL_PATH }}/server.crt; ssl_certificate_key {{ $.APP_SSL_PATH }}/server.key; ssl_protocols TLSv1.2; + ssl_prefer_server_ciphers on; keepalive_timeout 70; {{ if eq $.SPDY_SUPPORTED "true" }}add_header Alternate-Protocol {{ $.NGINX_SSL_PORT }}:npn-spdy/2;{{ end }} From 1c5896c3e32c1e85922fc63f1334bbec71a8ce76 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 20 Apr 2017 20:15:38 -0600 Subject: [PATCH 4/7] fix: be pci compliant by default Developers can override this in a custom nginx.conf.sigil. While it may be backwards incompatible - and will therefore require a minor release - it does make things much more secure. --- plugins/nginx-vhosts/install | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install index abf9bf7b7..afb5074ca 100755 --- a/plugins/nginx-vhosts/install +++ b/plugins/nginx-vhosts/install @@ -37,7 +37,7 @@ server_tokens off; ssl_session_cache shared:SSL:20m; ssl_session_timeout 1d; -ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'; +ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS; EOF fi From 9e021f889f0e157147885c4460b24d7a8a3892d0 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 20 Apr 2017 20:17:43 -0600 Subject: [PATCH 5/7] fix: disable ssl tickets This makes Perfect Forward Secrecy useless. --- plugins/nginx-vhosts/install | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install index afb5074ca..498507cf5 100755 --- a/plugins/nginx-vhosts/install +++ b/plugins/nginx-vhosts/install @@ -36,6 +36,7 @@ server_tokens off; # Settings from https://mozilla.github.io/server-side-tls/ssl-config-generator/ ssl_session_cache shared:SSL:20m; ssl_session_timeout 1d; +ssl_session_tickets on; ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS; From 9f9ecca59c0c2207aeb7bbcb6c5bb22689c6661e Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 20 Apr 2017 20:22:11 -0600 Subject: [PATCH 6/7] feat: support nginx 1.8.0 and up --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index 4924cf9a0..3bb5785d3 100644 --- a/debian/control +++ b/debian/control @@ -5,7 +5,7 @@ Priority: optional Architecture: amd64 Depends: locales, git, make, curl, gcc, man-db, sshcommand (>= 0.6.0), gliderlabs-sigil, docker-engine-cs (>= 1.9.1) | docker-engine (>= 1.9.1) | docker-ce | docker-ee, software-properties-common, python-software-properties Recommends: herokuish (>= 0.3.4), parallel -Pre-Depends: nginx, dnsutils, cgroupfs-mount | cgroup-lite, plugn (>= 0.3.0), sudo, python2.7, debconf +Pre-Depends: nginx (>= 1.8.0), dnsutils, cgroupfs-mount | cgroup-lite, plugn (>= 0.3.0), sudo, python2.7, debconf Maintainer: Jose Diaz-Gonzalez Description: Docker-powered PaaS that helps build and manage the lifecycle of applications Dokku is an extensible, open source Platform as a Service From 42860dd2a978101dd96db98e43050e581a322e4c Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 20 Apr 2017 21:35:29 -0600 Subject: [PATCH 7/7] feat: require nginx 1.8.0+ [ci skip] --- rpm.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rpm.mk b/rpm.mk index 67d7662d9..c1a904a14 100644 --- a/rpm.mk +++ b/rpm.mk @@ -95,7 +95,7 @@ endif --depends 'gliderlabs-sigil' \ --depends 'docker-engine >= 1.9.1' \ --depends 'bind-utils' \ - --depends 'nginx' \ + --depends 'nginx >= 1.8.0' \ --depends 'plugn' \ --depends 'sudo' \ --depends 'python' \