{"id":86701,"date":"2020-06-28T19:42:14","date_gmt":"2020-06-28T17:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition"},"modified":"2020-06-28T19:42:14","modified_gmt":"2020-06-28T17:42:14","slug":"uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","title":{"rendered":"Forbedring af SSL-forbindelsens sikkerhedsindstillinger i Zimbra Collaboration Suite Open-Source Edition.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

P\u00e5lideligheden af kryptering er en af de mest vigtige indikatorer, n\u00e5r informationssystemer anvendes til forretning, da de dagligt deltager i overf\u00f8rsel af enorme m\u00e6ngder fortrolig information. Et almindeligt anvendt middel til at vurdere kvaliteten af SSL-forbindelsen er den uafh\u00e6ngige test fra Qualys SSL Labs. Da denne test kan udf\u00f8res af hvem som helst, er det s\u00e6rligt vigtigt for SaaS-udbydere, at vurderingen i denne test er maksimal. Ikke kun SaaS-udbydere er opm\u00e6rksomme p\u00e5 kvaliteten af SSL-forbindelsen, men ogs\u00e5 almindelige virksomheder. For dem er denne test en fremragende mulighed for at identificere potentielle s\u00e5rbarheder og i god tid lukke alle smuthuller for cyberkriminelle.<\/p>\n

\"Forbedring<\/a><\/noindex>
\nI Zimbra OSE er to typer tilladt SSL certificates<\/a>. Den f\u00f8rste er et selvsigneret certifikat, som automatisk tilf\u00f8jes ved installation. Dette certifikat er gratis og tidsbegr\u00e6nset, hvilket g\u00f8r det ideelt til at teste Zimbra OSE eller kun anvende den inden for et internt netv\u00e6rk. Men n\u00e5r brugere logger ind p\u00e5 webklienten, vil de se en advarsel fra browseren om, at dette certifikat ikke er p\u00e5lideligt, og testen fra Qualys SSL Labs vil din server utvivlsomt dumpe.<\/p>\n

Den anden er et kommercielt SSL-certifikat, der er underskrevet af et certifikatutstedende organ. S\u00e5danne certifikater opfattes uden problemer af browsere og bruges typisk ved kommerciel drift af Zimbra OSE. Lige efter korrekt installation af det kommercielle certifikat viser Zimbra OSE 8.8.15 en A-vurdering i testen fra Qualys SSL Labs. Dette er et fremragende resultat, men vores m\u00e5l er at opn\u00e5 resultatet A+.<\/p>\n

\"Forbedring
\n
\n\"Forbedring
\n
\nFor at opn\u00e5 den maksimale vurdering i testen fra Qualys SSL Labs ved brug af Zimbra Collaboration Suite Open-Source Edition skal flere trin f\u00f8lges:<\/p>\n

1. For\u00f8gelse af parametrene for Diffie-Hellman-protokollen<\/b><\/p>\n

Som standard er parameterne for Diffie-Hellman-protokollen sat til 2048 bit i alle komponenter af Zimbra OSE 8.8.15, der bruger OpenSSL. I princippet er dette mere end tilstr\u00e6kkeligt til at opn\u00e5 en A+ vurdering p\u00e5 testen fra Qualys SSL Labs. Men hvis du opgraderer fra \u00e6ldre versioner, kan parameterne v\u00e6re lavere. Derfor anbefales det efter opdateringen at k\u00f8re kommandoen zmdhparam set -new 2048, som vil h\u00e6ve Diffie-Hellman-parametrene til de acceptable 2048 bit. Hvis \u00f8nskes, kan du ogs\u00e5 bruge denne samme kommando til at h\u00e6ve parameterne til 3072 eller 4096 bit, hvilket p\u00e5 den ene side vil \u00f8ge genereringstiden, men p\u00e5 den anden side forbedre sikkerheden p\u00e5 mailserveren.<\/p>\n

2. Aktivering af den anbefalede liste over anvendte krypteringsmetoder<\/b><\/p>\n

Som standard underst\u00f8tter Zimbra Collaboration Suite Open-Source Edition et bredt udvalg af st\u00e6rke og svage krypteringsmetoder, som bruges til at kryptere data, der sendes over en sikker forbindelse. Dog er brugen af svage krypteringsmetoder en alvorlig ulempe ved vurdering af sikkerheden af SSL-forbindelsen. For at undg\u00e5 dette er det n\u00f8dvendigt at konfigurere listen over anvendte krypteringsmetoder.<\/p>\n

For at g\u00f8re dette skal du bruge kommandoen zmprov mcf zimbraReverseProxySSLCiphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4'<\/code><\/p>\n

Denne kommando inkluderer straks s\u00e6ttet af anbefalede krypteringsmetoder, og med den kan du med det samme inkludere p\u00e5lidelige krypteringsmetoder i listen og udelukke usikre. Nu er det kun n\u00f8dvendigt at genstarte noderne med omvendt proxy ved hj\u00e6lp af kommandoen zmproxyctl restart. Efter genstarten tr\u00e6der de \u00e6ndringer, der er foretaget, i kraft.<\/p>\n

Hvis denne liste af en eller anden grund ikke opfylder dine behov, kan du fjerne nogle svage krypteringsmetoder fra den ved hj\u00e6lp af kommandoen zmprov mcf +zimbraSSLExcludeCipherSuites<\/code>. For eksempel kan kommandoen zmprov mcf +zimbraSSLExcludeCipherSuites TLS_RSA_WITH_RC4_128_MD5 +zimbraSSLExcludeCipherSuites TLS_RSA_WITH_RC4_128_SHA +zimbraSSLExcludeCipherSuites SSL_RSA_WITH_RC4_128_MD5 +zimbraSSLExcludeCipherSuites SSL_RSA_WITH_RC4_128_SHA +zimbraSSLExcludeCipherSuites TLS_ECDHE_RSA_WITH_RC4_128_SHA<\/code>, som helt udelukker brugen af RC4-kryptering. Det samme kan g\u00f8res med AES- og 3DES-krypteringer.<\/p>\n

3. Aktivering af HSTS<\/b><\/p>\n

Aktiverede mekanismer for tvangsaktivering af krypteringen af forbindelsen og gendannelse af TLS-sessioner er ogs\u00e5 obligatoriske krav for at opn\u00e5 topkarakter i testen fra Qualys SSL Labs. For at aktivere dem skal du indtaste kommandoen zmprov mcf +zimbraResponseHeader \"Strict-Transport-Security: max-age=31536000\"<\/code>. Denne kommando tilf\u00f8jer den n\u00f8dvendige header til konfigurationen, og for at de nye indstillinger tr\u00e6der i kraft skal Zimbra OSE genstartes med kommandoen zmcontrol restart<\/b>.<\/p>\n

Allerede p\u00e5 dette stadium vil testen fra Qualys SSL Labs vise en vurdering p\u00e5 A+, men hvis du \u00f8nsker at forbedre sikkerheden p\u00e5 din server yderligere, kan der tr\u00e6ffes en r\u00e6kke ekstra foranstaltninger.<\/p>\n

\"Forbedring
\n
\nFor eksempel kan du aktivere tvungen kryptering af interprocessforbindelser samt aktivere tvungen kryptering, n\u00e5r der oprettes forbindelse til Zimbra OSE-tjenester. For at kontrollere interprocessforbindelserne skal du indtaste f\u00f8lgende kommandoer:<\/p>\n

zmlocalconfig -e ldap_starttls_supported=1\nzmlocalconfig -e zimbra_require_interprocess_security=1\nzmlocalconfig -e ldap_starttls_required=true<\/code><\/pre>\n
\nFor at aktivere tvungen kryptering skal du indtaste:<\/p>\n
zmprov gs `zmhostname` zimbraReverseProxyMailMode\nzmprov ms `zmhostname` zimbraReverseProxyMailMode https\n\nzmprov gs `zmhostname` zimbraMailMode\nzmprov ms `zmhostname` zimbraMailMode https\n\nzmprov gs `zmhostname` zimbraReverseProxySSLToUpstreamEnabled\nzmprov ms `zmhostname` zimbraReverseProxySSLToUpstreamEnabled TRUE<\/code><\/pre>\n
Med disse kommandoer vil alle forbindelser til proxy-servere<\/a> og mailservere bliver krypteret, og alle disse forbindelser vil blive proxied.<\/p>\n
\"Forbedring
\n
\nDermed, ved at f\u00f8lge vores anbefalinger, kan du ikke kun opn\u00e5 den h\u00f8jeste vurdering i SSL-sikkerhedstesten, men ogs\u00e5 betydeligt forbedre sikkerheden i hele Zimbra OSE-infrastrukturen.<\/p>\n
Hvis du har sp\u00f8rgsm\u00e5l vedr\u00f8rende Zextras Suite, kan du kontakte virksomhedens repr\u00e6sentant \"Zextras\", Ekaterina Triandafiliidi, p\u00e5 e-mail katerina@zextras.com
\n
Kilde: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0430\u0434\u0435\u0436\u043d\u043e\u0441\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u0445 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u0431\u0438\u0437\u043d\u0435\u0441\u0430, \u0432\u0435\u0434\u044c \u0435\u0436\u0435\u0434\u043d\u0435\u0432\u043d\u043e \u043e\u043d\u0438 \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u041e\u0431\u0449\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u044b\u043c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043e\u0446\u0435\u043d\u043a\u0438 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0430 SSL-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0439 \u0442\u0435\u0441\u0442 \u043e\u0442 Qualys SSL Labs. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0439 \u0442\u0435\u0441\u0442 \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043a\u0442\u043e \u0443\u0433\u043e\u0434\u043d\u043e, \u0434\u043b\u044f SaaS-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432\u0430\u0436\u043d\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0446\u0435\u043d\u043a\u0430 \u0432 \u044d\u0442\u043e\u043c \u0442\u0435\u0441\u0442\u0435 \u0431\u044b\u043b\u0430 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439. \u041e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86702,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86701","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Forbedring af sikkerhedsparametre for SSL-forbindelse i Zimbra Collaboration Suite Open-Source Edition | ProHoster","description":"P\u00e5lideligheden af krypteringen er en af de vigtigste indikatorer, n\u00e5r man bruger informationssystemer til erhvervslivet, da de dagligt er involveret i overf\u00f8rslen af enorme m\u00e6ngder fortrolige oplysninger.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 SSL-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0432 Zimbra Collaboration Suite Open-Source Edition | ProHoster","og:description":"\u041d\u0430\u0434\u0435\u0436\u043d\u043e\u0441\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u0445 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u0431\u0438\u0437\u043d\u0435\u0441\u0430, \u0432\u0435\u0434\u044c \u0435\u0436\u0435\u0434\u043d\u0435\u0432\u043d\u043e \u043e\u043d\u0438 \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-28T17:42:14+00:00","article:modified_time":"2020-06-28T17:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86701","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:09:18","updated":"2026-02-19 09:14:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/86701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=86701"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/86701\/revisions"}],"predecessor-version":[{"id":161810,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/86701\/revisions\/161810"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/86702"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=86701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=86701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=86701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}