Securing client server communications using TLS

Online security is matter of concern for netizens as more and more services are being offered and consumed online which require people to divulge their personal, banking and credit card information to their service providers over the internet.
Information over the internet was predominantly transferred in non-secure format like HTTP, FTP and TELNET. This allowed man-in-the-middle attacks where a person can intercept the information as it travelled from the source to desination over the internet and obtain the information transferred through the non-secure protocols.
This presents a very grave situation for people who are performing bank transactions, credit card transactions, sending sensitive emails or sending or sharing personally identifiable information over the internet as this can be obtained by a third party very easily and exploited causing great monetary losses to the user.
Even though lot of websites have moved to secure protocols to provide their services like, e-commerce and social networking sites, but many a times the security protocols are not implemented correctly in their servers allowing hackers or crackers to break the secure protocol using the loopholes in the implementation of these secure protocols.
Below are few recommendations to implement Transport Layer Security (TLS) on popular internet servers to provide sufficiently secure transmissions of data between the server and the client, over the internet. Please note all the below examples are for servers which were built with OpenSSL TLS library.
Apache 2.4 webserver
Apache uses the configuration file apache2.conf or virtual host conf file to specify TLS related details.
To configure Apache to use TLS, provide the below directives in the apache2.conf file.
SSLCompression off |
SSLProtocol <TLS protocols allowed like -all +TLSv1.2 +TLSv1.1 +TLSv1> |
SSLCipherSuite <TLS ciphers allowed for securing the connection like TLSv1.2:TLSv1.1:TLSv1:AES256:AES128:!3DES:HIGH:!LOW:!MEDIUM:!EXP:!NULL:!eNULL:!aNULL:@STRENGTH> |
SSLHonorCipherOrder on |
SSLVerifyClient none |
Provide the below directives in the <virtual host>.conf file. Also please ensure your certificate key is of 2048 bits or more for better security.
SSLEngine on |
SSLCertificateFile <path to SSL certificate file> |
SSLCACertificateFile <path to SSL certificate CA file> |
SSLCertificateKeyFile <path to SSL certificate key file> |
Provide the below directive in the <virtual host>.conf for the host listening to unsecure port 80 to redirect all unsecure traffic to the secure URL.
Redirect permanent / https://www.yourdomain.com/ |
The above directive only applies if you allow unsecure http traffic on port 80 through the below configuration in the virtual host conf file.
<VirtualHost *:80>
Redirect permanent / https://www.yourdomain.com/
</VirtualHost *:80>
Provide the below directive to enforce HTTP Strict Transport Security in the virtual host.
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" |
The above directive to force web browsers to connect to your web server on HTTPS protocol only, even if unsecure protocol HTTP is used in the address bar. This prevents man-in-the-middle (MITM) hijacking of your HTTPS session during the initial redirection from unsecure HTTP to HTTPS session.
To enable OCSP stapling on Apache web server put the below directive in the main configuration file namely apache2.conf (not in the virtual host configuration file)
SSLUseStapling On SSLStaplingCache shmcb:${APACHE_RUN_DIR}/ssl_stapling(32768) |
Online Certificate Status Protocol (OCSP) stapling frees the web browser of your client from checking the revocation status of the SSL certificate presented by your Apache web browser as the server itself sends the response on behalf of the CA authority.
Postfix SMTP server
Postfix works both as a server and a client to receive and send mails respectively. Though sending and receiving mail can be done securely or unsecurely depending upon whether the remote server (to which you are sending or receiving mail from) supports TLS or not, but authenticating valid users who can send mail through your server i.e. relay mail through your server must be done securely. Unsecure transmission of authentication tokens like username and password can lead to someone getting hold of that information while in transit and using it to send emails on your behalf or for spamming. Authentication can be secured in Postfix by using the below directives in Postfix configuration files. I assume users connect to Postfix submission port 587 to send or relay emails through client software like Outlook or Thunderbird and smtp port 25 is closed for relay.
Put the below directives in master.cf file to use TLS for authentication.
submission inet n - - - - smtpd -o smtpd_tls_security_level=encrypt -o smtpd_tls_mandatory_protocols=<TLS protocols allowed like TLSv1.2:TLSv1.1:TLSv1:!SSLv3> -o smtpd_tls_mandatory_ciphers=high -o smtpd_sasl_auth_enable=yes -o smtpd_sasl_security_options=noanonymous -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_restrictions=reject_sender_login_mismatch |
You also need the below directives in the main.cf file. Please ensure your certificate key is of 2048 bits or more for better security.
tls_high_cipherlist = <TLS ciphers allowed for securing the connection like TLSv1.2:TLSv1.1:TLSv1:AES256:AES128:!3DES:HIGH:!LOW:!MEDIUM:!EXP:!NULL:!eNULL:!aNULL:@STRENGTH> smtpd_tls_cert_file = <path to SSL certificate file> smtpd_tls_CAfile = <path to SSL certificate CA files> smtpd_tls_key_file = <path to SSL certificate key file> |
To send secure emails using TLS use the below directives in main.cf file. The below directive falls back to unsecure email if the remote server does not have TLS capability.
smtp_tls_security_level = may smtp_tls_protocols = <TLS protocols allowed like TLSv1.2:TLSv1.1:TLSv1:!SSLv3> smtp_tls_ciphers = high |
To receive secure email using TLS use the below directives in main.cf file. The below directive falls back to unsecure email if the remote server does not have TLS capability. Please note that below directives start with smtpd and not smtp as above.
smtpd_tls_security_level = may smtpd_tls_protocols = <TLS protocols allowed like TLSv1.2:TLSv1.1:TLSv1:!SSLv3> smtpd_tls_ciphers = high |
Courier IMAP server
A lot of email traffic on the internet is served by IMAP servers. Many webmail clients, standalone email clients like Outlook, Thunderbird and mobile mail applications use IMAP internally to fetch email from user mailboxes and show it to users. So securing IMAP server is as important as securing a SMTP server. The below configuration will make the Courier IMAP server use TLS for both authentication and for tranfering mails from the user mailbox to the webmail or standalone client.
Add or uncomment and edit the below directives in the imapd-ssl configuration file as shown below.
IMAPDSTARTTLS=YES IMAP_TLS_REQUIRED=1 TLS_STARTTLS_PROTOCOL="<TLS protocols allowed like TLSv1.2:TLSv1.1:TLSv1:!SSLv3>" TLS_CIPHER_LIST="<TLS ciphers allowed for securing the connection like TLSv1.2:TLSv1.1:TLSv1:AES256:AES128:!3DES:HIGH:!LOW:!MEDIUM:!EXP:!NULL:!eNULL:!aNULL:@STRENGTH>" TLS_CERTFILE=<path to SSL certificate file and key file in PEM format> TLS_TRUSTCERTS=<path to SSL certificate CA files> |
Comment out the below directive as shown. This will allow the IMAP server to accept TLS connections on standard IMAP port 143 using STARTTLS instead of using the dedicated SSL port 993.
#IMAPDSSLSTART=YES |
OpenLDAP server
Securing OpenLDAP server is of prime importance for any organization and for individuals because LDAP servers provide authentication and authorization services to it's people. Any compromise of the OpenLDAP server can lead to a major breach of security and data theft and can cost any organization huge amount of money.
OpenLDAP provide both SSL and TLS security but we will focus on TLS as it's the preferred way to secure communication between the server and the client. OpenLDAP supports STARTTLS on the standard LDAP port 389 which allows the client to upgrade the insecure connection on the port to an encrypted one without connecting to another dedicated SSL port.
If you are using olc files for configuration, add the following attributes under DN cn=config using a ldif file.
olcTLSCertificateFile: <path to SSL certificate file> olcTLSCertificateKeyFile: <path to SSL certificate key file> olcTLSCACertificateFile: <path to SSL certificate CA files> olcTLSCipherSuite: <TLS ciphers allowed for securing the connection like SECURE128:-VERS-TLS-ALL:+VERS-TLS1.2:-RSA:-DHE-DSS:-CAMELLIA-128-CBC:-CAMELLIA-256-CBC:-AES-256-CBC:-AES-128-CBC:+COMP-NULL:%SAFE_RENEGOTIATION:%SERVER_PRECEDENCE> olcTLSVerifyClient: <whether client certificate needs to be verified, valid values are never | allow | try | demand> |
The ldap.conf counterparts for the above attributes are
TLSCertificateFile <path to SSL certificate file> TLSCertificateKeyFile <path to SSL certificate key file> TLSCACertificateFile <path to SSL certificate CA files> TLSCipherSuite <TLS ciphers allowed for securing the connection like SECURE128:-VERS-TLS-ALL:+VERS-TLS1.2:-RSA:-DHE-DSS:-CAMELLIA-128-CBC:-CAMELLIA-256-CBC:-AES-256-CBC:-AES-128-CBC:+COMP-NULL:%SAFE_RENEGOTIATION:%SERVER_PRECEDENCE> TLSVerifyClient <whether client certificate needs to be verified, valid values are never | allow | try | demand> |
Photo credit - https://blog.filippo.io/content/images/2017/09/Encrypting-the-Internet.0...
- Log in to post comments