A new beta release

When I test this version with www.ssllabs.com/ssltest/, I get a grade of F, specific to SSL testing we get:

Protocols
TLS 1.2 No
TLS 1.1 No
TLS 1.0 Yes
SSL 3 No
SSL 2 INSECURE Yes

Any thoughts on how to configure SmallWall to get the following response on SSL?:

Protocols
TLS 1.2 Yes
TLS 1.1 No
TLS 1.0 No
SSL 3 No
SSL 2 No

Also, here is the additional info recieved:

Protocol Details

Secure Renegotiation Supported

Secure Client-Initiated Renegotiation Supported DoS DANGER (more info)

Insecure Client-Initiated Renegotiation No

BEAST attack Not mitigated server-side (more info) TLS 1.0: 0x9

POODLE (SSLv3) No, SSL 3 not supported (more info)

POODLE (TLS) No (more info)

Downgrade attack prevention Unknown (requires support for at least two protocols)

SSL/TLS compression No

RC4 Yes WEAK (more info)

Heartbeat (extension) No

Heartbleed (vulnerability) No (more info)

OpenSSL CCS vuln. (CVE-2014-0224) No (more info)

Forward Secrecy No WEAK (more info)

Next Protocol Negotiation (NPN) No

Session resumption (caching) No (IDs assigned but not accepted)

Session resumption (tickets) Yes

OCSP stapling No

Strict Transport Security (HSTS) No

Public Key Pinning (HPKP) No

Long handshake intolerance No

TLS extension intolerance No

TLS version intolerance No

Incorrect SNI alerts No

Uses common DH primes No, DHE suites not supported

DH public server param (Ys) reuse No, DHE suites not supported

SSL 2 handshake compatibility Yes

Agreed, allowing specific IP's for 443 is an excellent practice.

We support a lot of locations that are not related, so supporting that many VPN's isn't really feasible.

Was hoping there was a simple way to disable SSL2 and TLS 1.0, and enable TLS 1.2.

Thoughts?

Hello!

It seems that Smallwall is using mini_httpd ver 1.21 from ACME Labs.
$ /usr/local/sbin/mini_httpd -V
mini_httpd/1.21 18oct2014

Note: There is a quite recent note about security issue related to this version. See: web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1548



But, based on my quick tests, this mini_httpd seems to have been compiled with openssl older than 1.0.2d. If I compile openssl-1.0.2d, I can use it and try to make connection like:
./apps/openssl s_client -connect www.google.com:443 -tls1_2
./apps/openssl s_client -connect www.google.com:443 -tls1_1
./apps/openssl s_client -connect www.google.com:443 -tls1

With OpenSSL 0.9.8zd only the last one works, but not the tls1_1 or tls1_2.

So, there is no command line option to enable tls1_1/tls1_2 on smallwall. Only way to use those is to recompile newest openssl and newest mini_httpd.

On the other hand, to have protocol support enable like beedsley mentioned, this needs to done while compiling the openssl and mini_httpd.

Any comments from Lee?

Hi,

I've not long installed the new beta as I think the 64 bit interface counters could come in useful, but I've just checked and it looks like they're still rolling over at around the 4GB mark. Is there an option I need to enable somewhere or are you referring to different counters?

Thanks