Improve TLS config - Githubissues

servo / saltfs

Salt Stack Filesystem

Apache License 2.0

56 stars 107 forks source link

Improve TLS config #913

Closed Darkspirit closed 5 years ago

Darkspirit commented 5 years ago

https://github.com/servo/saltfs/pull/906#issuecomment-436313032

Problem: https://www.hardenize.com/report/build.servo.org#www_tls https://www.ssllabs.com/ssltest/analyze.html?d=build.servo.org&hideResults=on

Let's first switch all clients to https before we disable TLS 1.0. Just to be sure.
server_tokens off; makes nginx return Server: nginx without any version number.
ssl_session_cache: official recommendation, docs

An nginx restart is needed: service nginx restart You can test with nginx -t before restarting.

This change is

Darkspirit commented 5 years ago

r? @jdm

jdm commented 5 years ago

One thing to be aware of - I changed a webhook target for servo/servo from http://build.servo.org:9010 to https://build.servo.org:9010 and it broke everything.

jdm commented 5 years ago

That's for https://github.com/servo/saltfs/blob/90036502c8fac2291fba372b3309bafef605f5b2/buildbot/master/files/buildbot-github-listener.conf#L1.

Darkspirit commented 5 years ago

One thing to be aware of - I changed a webhook target for servo/servo from http://build.servo.org:9010 to https://build.servo.org:9010 and it broke everything.

Oh dear. Of course, there is no starttls on an http port. I created another commit to introduce https://build.servo.org/github-buildbot/. Is this folder name okay or should we change it?

In the future, when all those plaintext services are behind nginx, they can be changed to only listen on 127.0.0.1. For github_buildbot.py it would be

either blocking port 9010 with iptables for the public
or changing https://github.com/servo/saltfs/blob/90036502c8fac2291fba372b3309bafef605f5b2/buildbot/master/files/github_buildbot.py#L306 to reactor.listenTCP(options.port, site, interface='127.0.0.1') (source 1, source 2).

Darkspirit commented 5 years ago

@jdm Should further changes be made, e.g. would you like to have a different name for the github_buildbot.py webhook, or is this ready to be merged? Thanks

bors-servo commented 5 years ago

:umbrella: The latest upstream changes (presumably #935) made this pull request unmergeable. Please resolve the merge conflicts.