SSL/TLS settings
Is it possible to modify the TLS settings for the SecuritySpy web server? After putting my own certificate and key on SecuritySpy, I decided to look at the TLS settings and cipher preferences. There are better options today than there probably were when these were chosen.
My preferences are similar to those found here:
https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
My preferences are similar to those found here:
https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
Comments
-
You are correct, there are better options now than the ones that SecuritySpy has been configured to use. This setting is currently not selectable, however we plan to add some user-configurable options to select which cyphers to enable, in an upcoming version of SecuritySpy.
-
Apologies for resurrecting an old thread, but I was wondering if anything was ever done about this. I don't see a way to remove older ciphers from the SecuritySpy web server. Is this still on the road map?
-
Yes, there is now a minimum encryption version setting that allows you to specify the TLS version that will be allowed for web server connections. By choosing TLS v1.2 here, this will restrict SecuritySpy's web server to only modern high-strength cyphers.
-
Thanks. I saw that setting and have it set to TLS 1.2, however, the server still offers insecure or weak ciphers such as RC4 and 3DES and offers RSA key exchange which is less that ideal. Is there a way to restrict the cipher suites offered when using TLS 1.2?
-
That's a good point. In the latest beta version of SecuritySpy I've added a new option to disable cyphers using less-secure protocols (RC4, DES, 3DES and MD5). As far as I'm aware there are no particular security issues with using RSA key exchange; please correct me if you think I'm wrong about this.
-
Thanks, that will be a welcome addition to the web server configuration.
I mentioned RSA key exchange in relation to PFS, so DHE-RSA is OK whereas RSA doesn't offer PFS which makes it less desirable. -
An alternative is to this is to put nginx, haproxy, apache, relayd, or some other proxy in front of the SecuritySpy system and terminate TLS on the the proxy. This takes the burden of managing TLS settings off of SecuritySpy. I did this with nginx and a let's encrypt certificate. Besides a solid TLS stack that I can configure myself, I also enjoy the benefits more verbose access logging.
