Security/Collab/86
Contents
Security Settings for Zimbra Collaboration 8.6 series
Proxy
Ciphers
The single valued zimbraReverseProxySSLCiphers attribute configures what cipher suites the nginx proxy will allow to be negotiated over SSL. This affects HTTPS when the web proxy is enabled, and POP and IMAP when the mail proxy is enabled. It is only possible to set this value in globalconfig.
The current recommended setting is (removes RC4 from the default in 8.6):
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4
It can be set using the zmprov mcf command
Protocols
The multi-valued attribute controlling the acceptable TLS protocol versions to be used by the nginx proxy is zimbraReverseProxySSLProtocols. It can be set at both the globalconfig and server level.
The current recommend values for this attribute are:
TLSv1 TLSv1.1 TLSv1.2
The values can be modified to either add or remove a protocol:
- zmprov mcf zimbraReverseProxySSLProtocols +protocol # add a protocol at the globalconfig level
- zmprov mcf zimbraReverseProxySSLProtocols -protocol # remove a protocol at the globalconfig level
If it is desired to have the servers have different protocol level settings, this can be done by setting the values at the server level:
- zmprov ms hostname zimbraReverseProxySSLProtocols +protocol # add a protocol at the server level
- zmprov ms hostname zimbraReverseProxySSLProtocols -protocol # remove a protocol at the server level
Mailboxd (Jetty)
Ciphers
The multi-valued attributes controlling the acceptable TLS ciphers to be used by mailboxd are zimbraSSLExcludeCipherSuites and zimbraSSLIncludeCipherSuites. They can be set at the globalconfig level.
- zimbraSSLExcludeCipherSuites
- excluded cipher suites
- zimbraSSLIncludeCipherSuites
- List of included cipher suites for Jetty. If any value is set only these ciphers will be used, in effect superseding zimbraSSLExcludeCipherSuites. Controlling the cipher suite order will be handled as part of bug 96928.
Default zimbraSSLExcludeCipherSuites settings in 8.6.0 (changing defaults to be addressed in bug 96929):
SSL_RSA_WITH_DES_CBC_SHA SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA SSL_RSA_EXPORT_WITH_RC4_40_MD5 SSL_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
Recommended (*may break compatibility with clients with limited capabilities):
.*_(3DES|RC4)_.*
Potential impacts:
- Excluding RC4 will likely cause problems for Windows XP users, possibly other very old clients.
- Keeping 3DES may still be desirable for interoperability with very old clients.
References:
- http://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html
- https://www.ssllabs.com/downloads/SSL_TLS_Deployment_Best_Practices.pdf
- http://www.symantec.com/connect/blogs/ssl-ciphers-beyond-private-key-and-certificate
- http://en.wikipedia.org/wiki/Transport_Layer_Security
Protocols
- zimbraMailboxdSSLProtocols
- contains a list of SSL/TLS protocols (as documented by SunJSSE Provider Protocols and used in setEnabledProtocols) to be enabled in Jetty for HTTPS, IMAPS, POP3S, and STARTTLS (including LMTP)
The current recommend values for this attribute are:
TLSv1 TLSv1.1 TLSv1.2
LDAP
The single-valued localconfig attributes controlling the acceptable TLS protocol versions and ciphers to be used by the OpenLDAP server are ldap_common_tlsprotocolmin and ldap_common_tlsciphersuite.
Protocols
- ldap_common_tlsprotocolmin
- Specifies minimum SSL/TLS protocol version that will be negotiated. To require TLS 1.x or higher, set this option to 3.(x+1), e.g., a value of 3.2 would require TLS 1.1.
Ciphers
- ldap_common_tlsciphersuite
Configures what ciphers will be accepted and the preference order for OpenSSL. To check what ciphers a given spec selects in OpenSSL, use: openssl ciphers -v cipher-suite-spec
The current recommend values for these localconfig settings are:
ldap_common_tlsprotocolmin = "3.1" ldap_common_tlsciphersuite = "MEDIUM:HIGH"
For more details see olcTLSCipherSuite and olcTLSProtocolMin in the OpenLDAP man page for slapd-config(5).
MTA
Protocols
The current recommend values for the MTA's protocol attributes are:
zimbraMtaSmtpdTlsProtocols = !SSLv2, !SSLv3 zimbraMtaLmtpTlsProtocols = !SSLv2, !SSLv3
Ciphers
The current recommend values for the MTA's ciphers attributes are:
zimbraMtaSmtpTlsCiphers = export zimbraMtaSmtpTlsMandatoryCiphers = export,low,medium,high,null zimbraMtaSmtpdTlsCiphers = export zimbraMtaSmtpdTlsExcludeCiphers = (empty) zimbraMtaSmtpdTlsMandatoryCiphers = medium zimbraMtaLmtpTlsCiphers = export zimbraMtaLmtpTlsExcludeCiphers = (empty) zimbraMtaLmtpTlsMandatoryCiphers = export,low,medium,high,null
For more details on Postfix TLS settings see http://www.postfix.org/TLS_README.html.
