Security Snippets on it-grossniklaus.ch

Erstellen eines CSR (openssl)

Mon, 01 Jan 0001 00:00:00 +0000

openssl req -new -key example.com.2048.encrypted.20141118.key  -out STAR.example.com.2048.20141119.csr

Enter pass phrase for example.com.2048.encrypted.20141118.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CH
State or Province Name (full name) [Some-State]:Bern
Locality Name (eg, city) []:Biel
Organization Name (eg, company) [Internet Widgits Pty Ltd]:example AG
Organizational Unit Name (eg, section) []:IT
Common Name (e.g. server FQDN or YOUR name) []:*.example.com
Email Address []:info@example.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

openssl req -text < STAR.example.com.2048.20141119.csr     > STAR.example.com.2048.20141119.csr.text

head -6 *.csr*

==> STAR.example.com.2048.20141119.csr <==
-----BEGIN CERTIFICATE REQUEST-----
MIICzDCCAbQCAQAwgYYxCzAJBgNVBAYTAkNIMQ0wCwYDVQQIDARCZXJuMQ0wCwYD
VQQHDARCaWVsMRMwEQYDVQQKDApleGFtcGxlIEFHMQswCQYDVQQLDAJJVDEWMBQG
A1UEAwwNKi5leGFtcGxlLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0BleGFtcGxl
LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM0Ti6Vw9RS2R8JX
O+1TCRCnTAzXN5N/uZ3nfOggqBiF94s0yj03mTvKplhgL/tP2j8+rHnFe8diZy2n

==> STAR.example.com.2048.20141119.csr.text <==
Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: C=CH, ST=Bern, L=Biel, O=example AG, OU=IT, CN=*.example.com/emailAddress=info@example.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption

Erstellen eines RSA Keys (openssl)

Mon, 01 Jan 0001 00:00:00 +0000

openssl genrsa -des3 -out example.com.2048.encrypted.20141118.key 2048

Generating RSA private key, 2048 bit long modulus
...........+++
........+++
e is 65537 (0x10001)
Enter pass phrase for example.com.2048.encrypted.20141118.key:********
Verifying - Enter pass phrase for example.com.2048.encrypted.20141118.key:*******

openssl rsa -in example.com.2048.encrypted.20141118.key -out example.com.2048.20141118.key

Enter pass phrase for example.com.2048.encrypted.20141118.key:********
writing RSA key

head -6 example.com.2048.*

==> example.com.2048.20141118.key <==
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAzROLpXD1FLZHwlc77VMJEKdMDNc3k3+5ned86CCoGIX3izTK
PTeZO8qmWGAv+0/aPz6secV7x2JnLadSOtD8NcLUIbO0q7sT7btuMfYqnaO6A5nu
1cPkwSD33rpdsuFu63eL8aruOYMO7/n/CIdesGG4QKKMqdAyQPwZfKqvpYkfJf8m
AGU2UxwLfbIHOjdX+iY/2MA4S61NYSvEfo7zg2HfoasrHJsGxWSXLHEfu/jBbFO/
N7ynSIWUzGwzajNDdAX4hbUaWU4AMD83ie4S9W6OdmzLZnhVVuYfuoMNwPBalCUq

==> example.com.2048.encrypted.20141118.key <==
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,D1CAE71425660625

Y5wJn3S38OauCykLPvLuXJPlkCWhnWAUrTBTC0W15CHCyqYDJK9+scZp8Zkq3kbw
bWUx64UIFzk5gehGj3wuvv4ObAaBPf4Z91GAsN2DOzWyucoVaClsgm7C+lp855/o

Härten des https Protokolls (SSL Offload)

Mon, 01 Jan 0001 00:00:00 +0000

Ziel: A Rating im SSL Server Test

    SSLProtocol ALL -SSLv2 -SSLv3
    SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
   
    SSLStrictSNIVHostCheck on

Härten des https Protokolls (SSL Offload)

Mon, 01 Jan 0001 00:00:00 +0000

Ziel: A Rating im SSL Server Test

global
  crt-base /etc/haproxy/ssl
  ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL

frontend  my_haproxy01_SSL_OFFLOAD_https
  bind    *:443 ssl crt /etc/haproxy/ssl-cert-snakeoil.pem crt /etc/haproxy/ssl/ no-sslv3

Zeige CERT unter einer IP ohne SNI (openssl)

Mon, 01 Jan 0001 00:00:00 +0000

openssl s_client -showcerts -connect 77.87.229.83:443 | grep -E 'subject=|issuer='

...
subject=/C=DE/O=Bundesamt fuer Sicherheit in der Informationstechnik/OU=Referat B23/ST=NRW/L=Bonn/emailAddress=oeffentlichkeitsarbeit@bsi.bund.de/CN=www.bsi.de
issuer=/C=DE/O=T-Systems International GmbH/OU=T-Systems Trust Center/ST=Nordrhein Westfalen/postalCode=57250/L=Netphen/street=Untere Industriestr. 20/CN=TeleSec ServerPass DE-2
...

Zeige Informationen über Zertifikat auf Webseite (nmap)

Mon, 01 Jan 0001 00:00:00 +0000

nmap -p 443 -sV -sC gmail.google.com

...
PORT    STATE SERVICE  VERSION
443/tcp open  ssl/http Google httpd 2.0 (GFE)
|_http-methods: No Allow or Public header in OPTIONS response (status code 405)
| http-robots.txt: 251 disallowed entries (15 shown)
| /search /sdch /groups /images /catalogs /catalogues
| /news /nwshp /setnewsprefs? /index.html? /? /?hl=*&
|_/?hl=*&*&gws_rd=ssl /addurl/image? /mail/
|_http-title: Site doesn't have a title (text/html; charset=ISO-8859-1).
| ssl-cert: Subject: commonName=*.google.com/organizationName=Google Inc/stateOrProvinceName=California/countryName=US
| Not valid before: 2014-11-05T11:35:52+00:00
|_Not valid after:  2015-02-03T00:00:00+00:00
|_ssl-date: 2014-11-13T22:41:34+00:00; -1s from local time.
| tls-nextprotoneg:
|   spdy/5a1
|   h2-15
|   spdy/3.1
|   spdy/3
|_  http/1.1
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Zeige Liste der unterstützten ciphers einer Webseite (sslscan)

Mon, 01 Jan 0001 00:00:00 +0000

https://github.com/rbsec/sslscan
sslscan tests SSL/TLS enabled services to discover supported cipher suites
(old) https://github.com/ioerror/sslscan
https://manpages.debian.org/stretch/sslscan/sslscan.1.en.html

sslscan www.bsi.de | grep Accepted

Accepted  TLSv1  256 bits  ECDHE-RSA-AES256-SHA
Accepted  TLSv1  256 bits  DHE-RSA-AES256-SHA
Accepted  TLSv1  256 bits  AES256-SHA
Accepted  TLSv1  128 bits  ECDHE-RSA-AES128-SHA
Accepted  TLSv1  128 bits  DHE-RSA-AES128-SHA
Accepted  TLSv1  128 bits  AES128-SHA
Accepted  TLSv1  128 bits  RC4-SHA

Zeige Liste der Zertifikate mit SNI (openssl)

Mon, 01 Jan 0001 00:00:00 +0000

openssl s_client -showcerts -connect gmail.google.com:443 -servername gmail.com

...
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=gmail.com
   i:/C=US/O=Google Inc/CN=Google Internet Authority G2
...
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
...
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
Server certificate
...
subject=/C=US/ST=California/L=Mountain View/O=Google Inc/CN=gmail.com
issuer=/C=US/O=Google Inc/CN=Google Internet Authority G2
...

Zeige Liste der Zertifikate ohne SNI (openssl)

Mon, 01 Jan 0001 00:00:00 +0000

openssl s_client -showcerts -connect www.bsi.de:443

...
Certificate chain
 0 s:/C=DE/O=Bundesamt fuer Sicherheit in der Informationstechnik/OU=Referat B23/ST=NRW/L=Bonn/emailAddress=oeffentlichkeitsarbeit@bsi.bund.de/CN=www.bsi.de
   i:/C=DE/O=T-Systems International GmbH/OU=T-Systems Trust Center/ST=Nordrhein Westfalen/postalCode=57250/L=Netphen/street=Untere Industriestr. 20/CN=TeleSec ServerPass DE-2
...
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-SHA
    Session-ID: F7FF28B085502ED75D4C34B3FF4EC830B8FC3125F7D3D763BB7546BC6BCF9800
    Session-ID-ctx:
    Master-Key: 0DBA413C657F3C02DFC4F8CACD98D7044E03923BD3F7C717CDD2A88B50AA9B4EA373E97A31354ECFA047157CDA553046
...