{"id":86701,"date":"2020-06-28T19:42:14","date_gmt":"2020-06-28T17:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition"},"modified":"2020-06-28T19:42:14","modified_gmt":"2020-06-28T17:42:14","slug":"uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","title":{"rendered":"SSL-\u00fchenduse turbeparameetrite parandamine Zimbra Collaboration Suite Open-Source Edition'is","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kr\u00fcptimise usaldusv\u00e4\u00e4rsus on \u00fcks olulisemaid n\u00e4itajaid ettev\u00f5tluses kasutatavate infotehnoloogiliste s\u00fcsteemide puhul, sest iga p\u00e4ev osalevad need tohutu hulga konfidentsiaalse teabe edastamises. SSL-\u00fchenduse kvaliteedi hindamisel on \u00fcldiselt aktsepteeritud vahend s\u00f5ltumatu test Qualys SSL Labsilt. Kuna seda testi saab k\u00e4ivitada iga\u00fchel, on SaaS-teenuse pakkujate jaoks eriti oluline, et hinne selles testis oleks maksimaalne. SSL-\u00fchenduse kvaliteedist hoolivad mitte ainult SaaS-teenuse pakkujad, vaid ka tavap\u00e4rased ettev\u00f5tted. Neile on see test suurep\u00e4rane v\u00f5imalus tuvastada potentsiaalselt n\u00f5rgad kohad ja ennetavalt kinni panna k\u00f5ik v\u00f5imalused k\u00fcberkurjategijate jaoks.<\/p>\n

\"SSL-\u00fchenduse<\/a><\/noindex>
\nZimbra OSE-s on lubatud kasutada kahte p\u00f5hivarianti SSL-sertifikaadid<\/a>. Esimene neist on isekirjutatud sertifikaat, mis lisatakse automaatselt paigaldamisel. See sertifikaat on tasuta ja ei ole ajaliselt piiratud, seega sobib see suurep\u00e4raselt Zimbra OSE testimiseks v\u00f5i selle kasutamiseks ainult sisev\u00f5rgus. Siiski, kui kasutajad sisenevad veebikliendisse, n\u00e4evad nad brauserilt hoiatust, et see sertifikaat ei ole usaldusv\u00e4\u00e4rne, ja test Qualys SSL Labsilt eba\u00f5nnestub teie serveri puhul kindlasti.<\/p>\n

Teine variant on kaubanduslik SSL-sertifikaat, mille on allkirjastanud sertifikaadi v\u00e4ljaandja. Selliseid sertifikaate ei teki brauseritega probleeme ja neid kasutatakse tavaliselt Zimbra OSE kaubanduslikuks kasutamiseks. Kohese p\u00e4rast korralikku kaubandusliku sertifikaadi installimist n\u00e4itab Zimbra OSE 8.8.15 hindeks A testi tulemust Qualys SSL Labsilt. See on suurep\u00e4rane tulemus, kuid meie eesm\u00e4rk on saavutada tulemus A+.<\/p>\n

\"SSL-\u00fchenduse
\n
\n\"SSL-\u00fchenduse
\n
\nSelleks, et saavutada maksimaalne hinne testi k\u00e4igus Qualys SSL Labsis Zimbra Collaboration Suite Open-Source Editioni kasutamisel, tuleb j\u00e4rgida mitmeid samme:<\/p>\n

1. Suurenda DiFi-Hellmani protokolli parameetreid<\/b><\/p>\n

Zimbra OSE 8.8.15 iga k\u00f5ikides komponentides, mis kasutavad OpenSSL, on Diffie-Hellmani protokolli parameetrite vaikev\u00e4\u00e4rtus 2048 bitti. See on p\u00f5him\u00f5tteliselt rohkem kui piisav, et saada \u00fclevaate A+ Qualys SSL Labs'i testist. Kuid vanematelt versioonidelt uuendades v\u00f5ivad parameetrite v\u00e4\u00e4rtused olla madalamad. Seet\u00f5ttu soovitatakse p\u00e4rast uuendamise l\u00f5petamist k\u00e4ivitada k\u00e4sk zmdhparam set -new 2048, mis t\u00f5stab Diffie-Hellmani protokolli parameetrid vastuv\u00f5etavatele 2048 bitile. Soovi korral on selle sama k\u00e4su abil v\u00f5imalik parameetrite v\u00e4\u00e4rtust t\u00f5sta ka 3072 v\u00f5i 4096 bitini, mis v\u00f5ib k\u00fcll pikendada genereerimisaega, kuid positiivselt m\u00f5jutab meiliserveri turvalisuse taset.<\/p>\n

2. Soovitatavate kr\u00fcptov\u00f5tmete loendi lubamine<\/b><\/p>\n

Vaikimisi toetab Zimbra Collaboration Suite Open-Source Edition laia valikut tugevaid ja n\u00f5rku kr\u00fcptov\u00f5tmeid, mida kasutatakse andmete kr\u00fcptimiseks kaitstud \u00fchenduse kaudu. Kuid n\u00f5rkade kr\u00fcptov\u00f5tmete kasutamine on t\u00f5sine puudus SSL-\u00fchenduse turvalisuse kontrolle. Selle v\u00e4ltimiseks tuleb seadistada kasutatavate kr\u00fcptov\u00f5tmete loetelu.<\/p>\n

Selleks tuleb kasutada k\u00e4sku zmprov mcf zimbraReverseProxySSLCiphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4'<\/code><\/p>\n

Sellesse k\u00e4sus on kohe m\u00e4rgitud soovitatud kr\u00fcptov\u00f5tmete komplekt, mille abil saab kohe lisada usaldusv\u00e4\u00e4rsed kr\u00fcptov\u00f5tmed ja v\u00e4listada ebausaldusv\u00e4\u00e4rsed. N\u00fc\u00fcd tuleb lihtsalt taask\u00e4ivitada vastupidised proksiserverid k\u00e4sku zmproxyctl restart kasutades. P\u00e4rast taask\u00e4ivitamist hakkavad muudatused kehtima.<\/p>\n

Kui see nimekiri mingil p\u00f5hjusel teile ei meeldi, saate m\u00f5ningaid n\u00f5rku kr\u00fcptov\u00f5tmeid eemaldada k\u00e4sku zmprov mcf +zimbraSSLExcludeCipherSuites<\/code>. N\u00e4iteks k\u00e4sk zmprov mcf +zimbraSSLExcludeCipherSuites TLS_RSA_WITH_RC4_128_MD5 +zimbraSSLExcludeCipherSuites TLS_RSA_WITH_RC4_128_SHA +zimbraSSLExcludeCipherSuites SSL_RSA_WITH_RC4_128_MD5 +zimbraSSLExcludeCipherSuites SSL_RSA_WITH_RC4_128_SHA +zimbraSSLExcludeCipherSuites TLS_ECDHE_RSA_WITH_RC4_128_SHA<\/code>, mis t\u00e4iesti v\u00e4listab RC4 kr\u00fcptode kasutamise. Samuti saab k\u00e4ituda ka AES ja 3DES kr\u00fcptodega.<\/p>\n

3. HSTS lubamine<\/b><\/p>\n

Sunnitud kr\u00fcptimise ja TLS-i sessiooni taastamise mehhanismide aktiveerimine on samuti n\u00f5utavad tingimused, et saada k\u00f5rgeim punktisumma Qualys SSL Labs'i testis. Nende aktiveerimiseks tuleb sisestada k\u00e4sk zmprov mcf +zimbraResponseHeader \"Strict-Transport-Security: max-age=31536000\"<\/code>. Antud k\u00e4sk lisab vajalikku p\u00e4ist konfiguratsiooni ning uute seadete j\u00f5ustumiseks tuleb Zimbra OSE taask\u00e4ivitada k\u00e4suga zmcontrol restart<\/b>.<\/p>\n

Juba sellel etapil n\u00e4itab Qualys SSL Labs'i test tulemust A+, kuid kui soovite oma serveri turvalisust veelgi parandada, on veel mitmeid meetmeid, mida saab v\u00f5tta.<\/p>\n

\"SSL-\u00fchenduse
\n
\nN\u00e4iteks, saab lubada sunnitud kr\u00fcptimise protsessidevahelistes \u00fchendustes ning samuti lubada sunnitud kr\u00fcptimise Zimbra OSE teenuste \u00fchendustel. Protsessidevaheliste \u00fchenduste kontrollimiseks tuleb sisestada j\u00e4rgmised k\u00e4sud:<\/p>\n

zmlocalconfig -e ldap_starttls_supported=1\nzmlocalconfig -e zimbra_require_interprocess_security=1\nzmlocalconfig -e ldap_starttls_required=true<\/code><\/pre>\n
\nSunnitud kr\u00fcptimise lubamiseks tuleb sisestada:<\/p>\n
zmprov gs `zmhostname` zimbraReverseProxyMailMode\nzmprov ms `zmhostname` zimbraReverseProxyMailMode https\n\nzmprov gs `zmhostname` zimbraMailMode\nzmprov ms `zmhostname` zimbraMailMode https\n\nzmprov gs `zmhostname` zimbraReverseProxySSLToUpstreamEnabled\nzmprov ms `zmhostname` zimbraReverseProxySSLToUpstreamEnabled TRUE<\/code><\/pre>\n
Nende k\u00e4skude abil kr\u00fcptitakse k\u00f5ik \u00fchendused proksiga-serveritega<\/a> ja meiliserveritega, samuti suunatakse k\u00f5ik need \u00fchendused.<\/p>\n
\"SSL-\u00fchenduse
\n
\nNii et j\u00e4rgides meie soovitusi on v\u00f5imalik saavutada mitte ainult k\u00f5rgeim hinnang SSL-isendi turvalisuse testis, vaid ka oluliselt suurendada kogu Zimbra OSE infrastruktuuri turvalisust.<\/p>\n
K\u00fcsimuste korral, mis on seotud Zextras Suite'iga, v\u00f5ite p\u00f6\u00f6rduda ettev\u00f5tte \u00abZextras\u00bb esindaja Ekaterina Triandafiliidi poole e-posti aadressil katerina@zextras.com
\n
Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0430\u0434\u0435\u0436\u043d\u043e\u0441\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u0445 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u0431\u0438\u0437\u043d\u0435\u0441\u0430, \u0432\u0435\u0434\u044c \u0435\u0436\u0435\u0434\u043d\u0435\u0432\u043d\u043e \u043e\u043d\u0438 \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u041e\u0431\u0449\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u044b\u043c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043e\u0446\u0435\u043d\u043a\u0438 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0430 SSL-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0439 \u0442\u0435\u0441\u0442 \u043e\u0442 Qualys SSL Labs. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0439 \u0442\u0435\u0441\u0442 \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043a\u0442\u043e \u0443\u0433\u043e\u0434\u043d\u043e, \u0434\u043b\u044f SaaS-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432\u0430\u0436\u043d\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0446\u0435\u043d\u043a\u0430 \u0432 \u044d\u0442\u043e\u043c \u0442\u0435\u0441\u0442\u0435 \u0431\u044b\u043b\u0430 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439. \u041e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86702,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86701","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 SSL-i \u00fchenduse turvaparameetrite parendamine Zimbra Collaboration Suite Open-Source Edition | ProHoster","description":"Kr\u00fcpteerimise usaldusv\u00e4\u00e4rsus on \u00fcks k\u00f5ige olulisemaid n\u00e4itajaid, kui kasutatakse \u00e4rilisi infosis\u00fcsteeme, kuna need osalevad igap\u00e4evaselt tohutul hulgal konfidentsiaalse teabe edastamises.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 SSL-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0432 Zimbra Collaboration Suite Open-Source Edition | ProHoster","og:description":"\u041d\u0430\u0434\u0435\u0436\u043d\u043e\u0441\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u0445 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u0431\u0438\u0437\u043d\u0435\u0441\u0430, \u0432\u0435\u0434\u044c \u0435\u0436\u0435\u0434\u043d\u0435\u0432\u043d\u043e \u043e\u043d\u0438 \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-28T17:42:14+00:00","article:modified_time":"2020-06-28T17:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86701","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:09:18","updated":"2026-02-19 09:14:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/86701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=86701"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/86701\/revisions"}],"predecessor-version":[{"id":161810,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/86701\/revisions\/161810"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/86702"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=86701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=86701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=86701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}