[PVE-User] Proxmox disable TLS 1
Ian Coetzee
proxmox at iancoetzee.za.net
Thu Jul 26 13:50:31 CEST 2018
Hi Uwe,
I won't mind, sanitised version below. This config gives me an A+ score on
www.ssllabs.com
It was originally sourced from
https://pve.proxmox.com/wiki/Web_Interface_Via_Nginx_Proxy with some tweaks
added by me over a period
$ sudo cat /etc/nginx/sites-enabled/proxmox-gui
> upstream proxmox {
> server localhost:8006;
> }
>
> server {
> listen 80 default_server;
> rewrite ^(.*) https:// permanent;
> }
>
> server {
> listen 443;
> server_name _;
> ssl on;
> ssl_certificate ***;
> ssl_certificate_key ***;
> ssl_protocols TLSv1.2;
> ssl_prefer_server_ciphers on;
> ssl_ciphers
> ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
> proxy_redirect off;
> server_tokens off;
> add_header X-XSS-Protection "1; mode=block";
> add_header X-Content-Type-Options nosniff;
> add_header X-Frame-Options SAMEORIGIN;
> proxy_hide_header X-Powered-By;
> location / {
> proxy_http_version 1.1;
> proxy_set_header Upgrade $http_upgrade;
> proxy_set_header Connection "upgrade";
> proxy_pass https://localhost:8006;
> proxy_buffering off;
> client_max_body_size 0;
> proxy_connect_timeout 3600s;
> proxy_read_timeout 3600s;
> proxy_send_timeout 3600s;
> send_timeout 3600s;
> }
> }
>
NoVNC, xterm.js and Spice works perfectly.
Kind regards
On 26 July 2018 at 13:27, Uwe Sauter <uwe.sauter.de at gmail.com> wrote:
> Would you mind to share the relevant parts of your nginx config? Does
> forwarding NoVNC traffic work?
>
>
>
> Am 26.07.2018 um 13:22 schrieb Ian Coetzee:
> > Hi All,
> >
> > I know this has been answered.
> >
> > What I did was to drop a reverse proxy (nginx) in front of pveproxy
> > listening on port 443 then make the needed changes in the nginx config
> >
> > Makes my life way easier :)
> >
> > On 26 July 2018 at 11:38, Thomas Lamprecht <t.lamprecht at proxmox.com>
> wrote:
> >
> >> Am 07/26/2018 um 11:30 AM schrieb Brent Clark:
> >>
> >>> Thanks for replying
> >>>
> >>> Interesting, I do not have that file / package.
> >>>
> >>>
> >> Just create it, it's not there by default but gets considered by
> >> pveproxy - if there. And pveproxy resides in the pve-manager package
> >>
> >> root at chs-vmh01 ~ # dpkg -l | awk '/pve-/{print $2" "$3}'
> >>>
> >>
> >> Not all our packages begin with pve, e.g. qemu-server, novnc-pve, etc.
> >>
> >> Use `pveversion -v` to get a list of all packages directly relevant to
> >> PVE and it's version quickly, can also be found in the Web UI (Node ->
> >> Summary -> Package versions)
> >>
> >> cheers,
> >> Thomas
> >>
> >>
> >>
> >>> snippet
> >>>
> >>> pve-cluster 5.0-28
> >>> pve-container 2.0-24
> >>> pve-docs 5.2-4
> >>> pve-edk2-firmware 1.20180612-1
> >>> pve-firewall 3.0-13
> >>> pve-firmware 2.0-5
> >>> pve-ha-manager 2.0-5
> >>> pve-i18n 1.0-6
> >>> pve-kernel-4.15 5.2-4
> >>> pve-kernel-4.15.15-1-pve 4.15.15-6
> >>> pve-kernel-4.15.17-1-pve 4.15.17-9
> >>> pve-kernel-4.15.17-3-pve 4.15.17-14
> >>> pve-kernel-4.15.18-1-pve 4.15.18-15
> >>> pve-libspice-server1 0.12.8-3
> >>> pve-manager 5.2-5
> >>> pve-qemu-kvm 2.11.2-1
> >>> pve-xtermjs 1.0-5
> >>>
> >>> Regards
> >>> Brent
> >>>
> >>>
> >>> On 26/07/2018 11:22, Thomas Lamprecht wrote:
> >>>
> >>>> Hi,
> >>>>
> >>>> Am 07/26/2018 um 11:05 AM schrieb Brent Clark:
> >>>>
> >>>>> Good day Guys
> >>>>>
> >>>>> I did a sslscan on my proxmox host, and I got the following:
> >>>>>
> >>>>> snippet:
> >>>>> Preferred TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Curve
> P-256
> >>>>> DHE 256
> >>>>> Accepted TLSv1.0 256 bits DHE-RSA-AES256-SHA DHE 2048
> bits
> >>>>> Accepted TLSv1.0 256 bits DHE-RSA-CAMELLIA256-SHA DHE 2048
> bits
> >>>>> Accepted TLSv1.0 256 bits AES256-SHA
> >>>>> Accepted TLSv1.0 256 bits CAMELLIA256-SHA
> >>>>> Accepted TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve
> P-256
> >>>>> DHE 256
> >>>>> Accepted TLSv1.0 128 bits DHE-RSA-AES128-SHA DHE 2048
> bits
> >>>>> Accepted TLSv1.0 128 bits DHE-RSA-SEED-SHA DHE 2048
> bits
> >>>>> Accepted TLSv1.0 128 bits DHE-RSA-CAMELLIA128-SHA DHE 2048
> bits
> >>>>> Accepted TLSv1.0 128 bits AES128-SHA
> >>>>> Accepted TLSv1.0 128 bits SEED-SHA
> >>>>> Accepted TLSv1.0 128 bits CAMELLIA128-SHA
> >>>>>
> >>>>> I need to remove / disable TLSv1.0. Google has not been able to be of
> >>>>> much help, for I get suggestions to edit
> >>>>> /usr/bin/pveproxy and /etc/default/pveproxy and the list goes on.
> >>>>>
> >>>>> > Can someone suggest how to fix this issue.
> >>>>
> >>>> Ah yes, I posted a possible quick solution for this in the forum a bit
> >>>> ago [0].
> >>>>
> >>>> Edit /etc/default/pveproxy to have a line with:
> >>>>
> >>>> CIPHERS="HIGH:!TLSv1:!SSLv3:!aNULL:!MD5"
> >>>>
> >>>> then
> >>>> systemctl restart pveproxy
> >>>>
> >>>> and you should be good to go :-)
> >>>>
> >>>> cheers,
> >>>> Thomas
> >>>>
> >>>> [0]: https://forum.proxmox.com/threads/disabling-tls-1-0-and-1-1-
> >>>> in-proxmox.35814/#post-175643
> >>>>
> >>>>
> >>>>
> >>>> _______________________________________________
> >>> pve-user mailing list
> >>> pve-user at pve.proxmox.com
> >>> https://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user
> >>>
> >>
> >>
> >> _______________________________________________
> >> pve-user mailing list
> >> pve-user at pve.proxmox.com
> >> https://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user
> >>
> > _______________________________________________
> > pve-user mailing list
> > pve-user at pve.proxmox.com
> > https://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user
> >
>
> _______________________________________________
> pve-user mailing list
> pve-user at pve.proxmox.com
> https://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user
>
More information about the pve-user
mailing list