pveproxy - Disable weak SSL ciphers?

[Stoiko Ivanov]

You can configure the cipher-list used by pveproxy (see https://pve.proxmox.com/pve-docs/pveproxy.8.html) - maybe this helps in your situation?

Do you have a use-case where the SSL_honor_cipher_order would improve security/usability over just being able to specify the ciphers?

 

[Horloge]

You can configure the cipher-list used by pveproxy (see https://pve.proxmox.com/pve-docs/pveproxy.8.html) - maybe this helps in your situation?

Do you have a use-case where the SSL_honor_cipher_order would improve security/usability over just being able to specify the ciphers?

Hey,

Yeah thanks for having let the possibility to set it within our configuration, it's appreciated.

Typically, with a ciphers list as below (the best ones taken from cryptcheck. fr/ciphers) :

CIPHERS="ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"

... Firefox would still choose the ECDHE-RSA-AES128-GCM-SHA256 one.

I think this case resumes the behavior well : If we want to offer a specific list to assure compatibility, the most secure one won't be chosen automatically, even if it could.
The SSL_honor_cipher_order would fix that !

 

[Horloge]

Hi over here (and a happy new year to the team). Were you able to discuss this internally on your side ? Bye

 

[Stoiko Ivanov]

Hi,
Happy new year as well!

Sorry that got a bit lost - could I ask you to open an feature-request at https://bugzilla.proxmox.com

However - also consider putting an full-fledged https-proxy/server in front of it (nginx, haproxy, ...) - there you usually get all the TLS-knobs should you need them.

 

[Horloge]

Thanks for your feedback @Stoiko Ivanov, here you are : https://bugzilla.proxmox.com/show_bug.cgi?id=2069

--> I got your point, but using another WEB server in front of PVEProxy would add an irrelevant layer and thus overhead to an out-of-the-box setup, already ready for the "outside" with the rest of the configuration and possibilities

Bye