/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos.conf.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-03-10 18:03:38 UTC
  • mto: (237.7.304 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150310180338-pcxw6r2qmw9k6br9
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.

If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default.  The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.

There is a "PFS" priority string specifier, but we can't use it because:

1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
   enables a lot more algorithms than "SECURE256".

2. It is only available since GnuTLS 3.2.4.

Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.

Show diffs side-by-side

added added

removed removed

Lines of Context:
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY CONFNAME "mandos.conf">
5
5
<!ENTITY CONFPATH "<filename>/etc/mandos/mandos.conf</filename>">
6
 
<!ENTITY TIMESTAMP "2018-02-08">
 
6
<!ENTITY TIMESTAMP "2013-10-23">
7
7
<!ENTITY % common SYSTEM "common.ent">
8
8
%common;
9
9
]>
34
34
    <copyright>
35
35
      <year>2008</year>
36
36
      <year>2009</year>
37
 
      <year>2010</year>
38
37
      <year>2011</year>
39
38
      <year>2012</year>
40
39
      <year>2013</year>
41
 
      <year>2014</year>
42
 
      <year>2015</year>
43
 
      <year>2016</year>
44
 
      <year>2017</year>
45
 
      <year>2018</year>
46
40
      <holder>Teddy Hogeborn</holder>
47
41
      <holder>Björn Påhlsson</holder>
48
42
    </copyright>
127
121
        <term><option>priority<literal> = </literal><replaceable
128
122
        >STRING</replaceable></option></term>
129
123
        <listitem>
130
 
          <xi:include href="mandos-options.xml" xpointer="priority"/>
 
124
          <xi:include href="mandos-options.xml"
 
125
                      xpointer="priority_compat"/>
131
126
        </listitem>
132
127
      </varlistentry>
133
128
      
206
201
      built-in module <systemitem class="library">ConfigParser</systemitem>
207
202
      requires it.
208
203
    </para>
209
 
    <xi:include href="bugs.xml"/>
210
204
  </refsect1>
211
205
  
212
206
  <refsect1 id="example">
229
223
interface = eth0
230
224
address = fe80::aede:48ff:fe71:f6f2
231
225
port = 1025
232
 
debug = True
233
 
priority = SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA
 
226
debug = true
 
227
priority = SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP
234
228
servicename = Daena
235
229
use_dbus = False
236
230
use_ipv6 = True