Vulnerbilities affecting Web and Mail Servers - Logjam-Freak

 Recently we came across a vulnerability know as Logjam which according to researchers any attacker or Man in the middle can exploit weak Diffie–Hellman key Algorithm.

this vulnerability has denoted with CVE number as CVE-2015-4000. 

How DH Algorithm gets exploited

Traditionally, secure encrypted communication between two parties (here browser and servers) required that they first exchange keys by some secure physical channel.The Diffie–Hellman key exchange method allows two parties that have no prior knowledge of each other to jointly establish a shared secret key over an insecure channel. 

Here attacker can force the communication between the server and browser to downgrade to lower bit export grade cryptography.

The attackers can attacks any servers that support DHE_EXPORT ciphers and affects mostly all browsers.

Recommendation :

1) Disable Export Cipher Suites

Even though modern browsers no longer support export suites, the FREAK and Logjam attacks allow a man-in-the-middle attacker to trick browsers into using export-grade cryptography, after which the TLS connection can be decrypted. No modern clients rely on export suites and there is little downside in disabling them.

Put below Cipher in your configurations ,this cipher will support wide range of clients thus this configuration is default and is recommended by Mozilla community.

ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA

2)Deploy (Ephemeral) Elliptic-Curve Diffie-Hellman (ECDHE) Cipher

  above Cipher will enable ECDHE also

3) Use a Strong, Diffie Hellman Group

Current DH bit is of 1024,so you need to generate custom  2048  bit DH parameters different from Oakley group 2 (in this group Diffie-Hellman exchange is negotiated)

To Generate the Strong DH group use below command on your linux machine.

openssl dhparam -out dhparams.pem 2048

The command will take some time to generate,once its done, use dhparams.pem in your configuration and reload the services.

Services which need to be updated with Ciphers and custom DH groups we just generated.

lighttpd
Tomcat
Postfix
Sendmail
Dovecot
HAproxy
Openssh

====================================X============X=================================================

Contact support@linuxforeveryone for any Freelancing work on Linux Servers

Subscribe my YouTube Channel 

Like My Facebook Page 

Browse the Best in class Web Hosting Plans