influxdata / influxdata/influxdb

3DES cipher present even after adding `tls-strict-ciphers`

Open
#23,407 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

__Steps to reproduce:__
Start influxdb with a configuration for TLS as follows:

```
https-certificate = "client.crt"
https-private-key = "client.key"
tls-strict-ciphers = true #trying all combinations
[tls]
min-version = "tls1.2"
max-version = "tls1.3"
tls-strict-ciphers = true #trying all combinations
strict-ciphers = true #trying all combinations
```

__Expected behavior:__
The strict cipher suites are the only options given to client.

__Actual behavior:__

nmap -sV --script ssl-enum-ciphers -p 8086 localhost
```
Starting Nmap 7.60 ( https://nmap.org ) at 2022-06-07 09:23 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000054s latency).
Other addresses for localhost (not scanned): ::1
rDNS record for 127.0.0.1: 1c9d847e-c4eb-44ea-b301-e8a22cb5f04d

PORT STATE SERVICE VERSION
8086/tcp open ssl/http InfluxDB http admin 1.8.10
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
| compressors:
| NULL
| cipher preference: client
| warnings:
| 64-bit block cipher 3DES vulnerable to SWEET32 attack
|_ least strength: C

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.67 seconds
```
3DES cipehers are still present
__Environment info:__

* System info: Linux 5.4.0-110-generic x86_64
* InfluxDB version: InfluxDB v1.8.10 (git: 1.8 688e697c51fd)
* Other relevant environment details: Normal VM

__Config:__

```
[meta]
dir = "/var/vcap/store/influxdb/meta"

[data]
dir = "/var/vcap/store/influxdb/data"
wal-dir = "/var/vcap/store/influxdb/wal"
index-version = "tsi1"
query-log-enabled = true

[coordinator]
log-queries-after = "20s"

[http]
auth-enabled = true
log-enabled = true
pprof-enabled = false
flux-enabled = true
https-enabled = true
https-certificate = "/var/vcap/jobs/influxdb/config/client.crt"
https-private-key = "/var/vcap/jobs/influxdb/config/client.key"
tls-strict-ciphers = true
[tls]
min-version = "tls1.2"
max-version = "tls1.3"
tls-strict-ciphers = true
strict-ciphers = true

[[graphite]]
enabled = true
database = "metrics"
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the reported HTTP TLS configuration with tls-strict-ciphers and the [tls] min/max-version settings, then inspect how those options affect the server's advertised cipher suites. Use the provided nmap ssl-enum-ciphers command to verify the result; done means 3DES suites are no longer offered while the configured TLS versions remain available.

Written by the indexing model from the issue text.

Assessment

Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.