{"id":86701,"date":"2020-06-28T19:42:14","date_gmt":"2020-06-28T17:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition"},"modified":"2020-06-28T19:42:14","modified_gmt":"2020-06-28T17:42:14","slug":"uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","title":{"rendered":"\u00cembun\u0103t\u0103\u021birea parametrilor de securitate SSL \u00een Zimbra Collaboration Suite Open-Source Edition","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Fiabilitatea cript\u0103rii este unul dintre cei mai importan\u021bi indicatori \u00een utilizarea sistemelor informa\u021bionale pentru afaceri, av\u00e2nd \u00een vedere c\u0103 ele sunt implicate zilnic \u00een transmiterea unei cantit\u0103\u021bi uria\u0219e de informa\u021bii confiden\u021biale. Un instrument comun de evaluare a calit\u0103\u021bii unei conexiuni SSL este testul independent de la Qualys SSL Labs. Deoarece acest test poate fi rulat de oricine, pentru furnizorii de SaaS este esen\u021bial ca evaluarea \u00een acest test s\u0103 fie maxim\u0103. Nu doar furnizorii de SaaS se \u00eengrijesc de calitatea conexiunii SSL, ci \u0219i \u00eentreprinderile obi\u0219nuite. Pentru acestea, acest test reprezint\u0103 o oportunitate excelent\u0103 de a identifica poten\u021bialele puncte vulnerabile \u0219i de a \u00eenchide din timp toate bre\u0219ele pentru cibercriminali.<\/p>\n

\"\u00cembun\u0103t\u0103\u021birea<\/a><\/noindex>
\n\u00cen Zimbra OSE sunt acceptate dou\u0103 tipuri certificatelor SSL<\/a>. Primul este certificat auto-semnat, care se adaug\u0103 automat la instalare. Acest certificat este gratuit \u0219i nu are restric\u021bii de utilizare \u00een timp, ceea ce \u00eenseamn\u0103 c\u0103 este ideal pentru testarea Zimbra OSE sau pentru utilizarea acesteia exclusiv \u00een cadrul re\u021belei interne. Totu\u0219i, la accesarea clientului web, utilizatorii vor vedea un avertisment din partea browser-ului c\u0103 acest certificat nu este de \u00eencredere, iar testul de la Qualys SSL Labs va fi e\u0219uat definitiv de serverul dumneavoastr\u0103.<\/p>\n

Al doilea este un certificat SSL comercial, semnat de o autoritate de certificare. Aceste certificate sunt acceptate f\u0103r\u0103 probleme de browsere \u0219i sunt folosite de obicei \u00een exploatarea comercial\u0103 a Zimbra OSE. Imediat dup\u0103 instalarea corect\u0103 a certificatului comercial, Zimbra OSE 8.8.15 afi\u0219eaz\u0103 nota A \u00een testul de la Qualys SSL Labs. Acesta este un rezultat excelent, dar obiectivul nostru este s\u0103 atingem rezultatul A+.<\/p>\n

\"\u00cembun\u0103t\u0103\u021birea
\n
\n\"\u00cembun\u0103t\u0103\u021birea
\n
\nPentru a atinge cea mai mare evaluare \u00een testul de la Qualys SSL Labs atunci c\u00e2nd folosi\u021bi Zimbra Collaboration Suite Open-Source Edition, trebuie s\u0103 urma\u021bi c\u00e2\u021biva pa\u0219i:<\/p>\n

1. Cre\u0219terea parametrilor protocolului Diffie-Hellman<\/b><\/p>\n

\u00cen mod implicit, \u00een toate componentele Zimbra OSE 8.8.15 care folosesc OpenSSL, valoarea parametrilor protocolului Diffie-Hellman este de 2048 bi\u021bi. \u00cen principiu, aceasta este mai mult dec\u00e2t suficient\u0103 pentru a ob\u021bine un rating A+ \u00een testul Qualys SSL Labs. Cu toate acestea, \u00een cazul \u00een care face\u021bi upgrade de la versiuni mai vechi, valoarea parametrilor poate fi mai mic\u0103. Prin urmare, se recomand\u0103 ca, dup\u0103 finalizarea actualiz\u0103rii, s\u0103 rula\u021bi comanda zmdhparam set -new 2048, care va ridica parametrii protocolului Diffie-Hellman la acceptabili 2048 bi\u021bi; de asemenea, prin aceast\u0103 comand\u0103, pute\u021bi s\u0103 cre\u0219te\u021bi valoarea parametrilor la 3072 sau 4096 bi\u021bi, ceea ce, pe de o parte, va duce la o cre\u0219tere a timpului de generare, dar, pe de alt\u0103 parte, va \u00eembun\u0103t\u0103\u021bi nivelul de securitate al serverului de e-mail.<\/p>\n

2. Activarea listei recomandate de cipher-uri utilizate<\/b><\/p>\n

\u00cen mod implicit, Zimbra Collaboration Suite Open-Source Edition suport\u0103 o gam\u0103 larg\u0103 de cipher-uri puternice \u0219i slabe, prin care sunt criptate datele ce trec pe o conexiune securizat\u0103. Totu\u0219i, utilizarea cipher-urilor slabe reprezint\u0103 un dezavantaj semnificativ \u00een auditul securit\u0103\u021bii conexiunii SSL. Pentru a evita acest lucru, necesit\u0103 configurarea listei de cipher-uri utilizate.<\/p>\n

Pentru aceasta, trebuie s\u0103 folosi\u021bi comanda zmprov mcf zimbraReverseProxySSLCiphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4'<\/code><\/p>\n

Aceast\u0103 comand\u0103 include imediat un set de cipher-uri recomandate \u0219i, gra\u021bie ei, se pot ad\u0103uga direct \u00een list\u0103 cipher-uri de \u00eencredere \u0219i se pot exclude pe cele nesigure. Acum r\u0103m\u00e2ne doar s\u0103 restarta\u021bi nodurile cu proxy invers cu comanda zmproxyctl restart. Dup\u0103 restart, modific\u0103rile efectuate vor avea efect.<\/p>\n

\u00cen cazul \u00een care aceast\u0103 list\u0103 nu v\u0103 satisface din diverse motive, pute\u021bi elimina din ea c\u00e2teva cipher-uri slabe folosind comanda zmprov mcf +zimbraSSLExcludeCipherSuites<\/code>. De exemplu, comanda zmprov mcf +zimbraSSLExcludeCipherSuites TLS_RSA_WITH_RC4_128_MD5 +zimbraSSLExcludeCipherSuites TLS_RSA_WITH_RC4_128_SHA +zimbraSSLExcludeCipherSuites SSL_RSA_WITH_RC4_128_MD5 +zimbraSSLExcludeCipherSuites SSL_RSA_WITH_RC4_128_SHA +zimbraSSLExcludeCipherSuites TLS_ECDHE_RSA_WITH_RC4_128_SHA<\/code>, care va exclude complet utilizarea cifrurilor RC4. Pute\u021bi face acela\u0219i lucru \u0219i cu cifrurile AES \u0219i 3DES.<\/p>\n

3. Activarea HSTS<\/b><\/p>\n

Mecanismele activate de impunere a cript\u0103rii conexiunii \u0219i restaur\u0103rii sesiunilor TLS sunt, de asemenea, condi\u021bii obligatorii pentru a ob\u021bine cea mai \u00eenalt\u0103 not\u0103 la testul de la Qualys SSL Labs. Pentru a le activa, trebuie s\u0103 introduce\u021bi comanda zmprov mcf +zimbraResponseHeader \"Strict-Transport-Security: max-age=31536000\"<\/code>. Aceast\u0103 comand\u0103 va ad\u0103uga antetul necesar \u00een configura\u021bie, iar pentru ca noile set\u0103ri s\u0103 aib\u0103 efect, va trebui s\u0103 reporni\u021bi Zimbra OSE cu comanda zmcontrol restart<\/b>.<\/p>\n

Deja \u00een aceast\u0103 etap\u0103, testul de la Qualys SSL Labs va ar\u0103ta un scor A+, \u00eens\u0103 dac\u0103 dori\u021bi s\u0103 \u00eembun\u0103t\u0103\u021bi\u021bi suplimentar securitatea serverului dumneavoastr\u0103, pute\u021bi lua \u0219i alte m\u0103suri.<\/p>\n

\"\u00cembun\u0103t\u0103\u021birea
\n
\nDe exemplu, pute\u021bi activa criptarea for\u021bat\u0103 a conexiunilor \u00eentre procese, precum \u0219i activarea cript\u0103rii for\u021bate atunci c\u00e2nd v\u0103 conecta\u021bi la serviciile Zimbra OSE. Pentru a verifica conexiunile \u00eentre procese, trebuie s\u0103 introduce\u021bi urm\u0103toarele comenzi:<\/p>\n

zmlocalconfig -e ldap_starttls_supported=1\nzmlocalconfig -e zimbra_require_interprocess_security=1\nzmlocalconfig -e ldap_starttls_required=true<\/code><\/pre>\n
\nPentru a activa criptarea for\u021bat\u0103, trebuie s\u0103 introduce\u021bi:<\/p>\n
zmprov gs `zmhostname` zimbraReverseProxyMailMode\nzmprov ms `zmhostname` zimbraReverseProxyMailMode https\n\nzmprov gs `zmhostname` zimbraMailMode\nzmprov ms `zmhostname` zimbraMailMode https\n\nzmprov gs `zmhostname` zimbraReverseProxySSLToUpstreamEnabled\nzmprov ms `zmhostname` zimbraReverseProxySSLToUpstreamEnabled TRUE<\/code><\/pre>\n
Datorit\u0103 acestor comenzi, toate conexiunile cu serverele proxy-servers<\/a> \u0219i serverele po\u0219tale vor fi criptate, iar toate aceste conexiuni vor fi proxied.<\/p>\n
\"\u00cembun\u0103t\u0103\u021birea
\n
\nAstfel, urm\u00e2nd recomand\u0103rile noastre, nu numai c\u0103 ve\u021bi ob\u021bine o not\u0103 excelent\u0103 \u00een testul de securitate a conexiunii SSL, dar ve\u021bi \u00eembun\u0103t\u0103\u021bi semnificativ securitatea \u00eentregii infrastructuri Zimbra OSE.<\/p>\n
Pentru orice \u00eentreb\u0103ri legate de Zextras Suite, pute\u021bi contacta reprezentanta companiei \u201eZextras\u201d Ekaterina Triandafylidi la adresa de email katerina@zextras.com
\n
Sursa: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0430\u0434\u0435\u0436\u043d\u043e\u0441\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u0445 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u0431\u0438\u0437\u043d\u0435\u0441\u0430, \u0432\u0435\u0434\u044c \u0435\u0436\u0435\u0434\u043d\u0435\u0432\u043d\u043e \u043e\u043d\u0438 \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u041e\u0431\u0449\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u044b\u043c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043e\u0446\u0435\u043d\u043a\u0438 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0430 SSL-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0439 \u0442\u0435\u0441\u0442 \u043e\u0442 Qualys SSL Labs. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0439 \u0442\u0435\u0441\u0442 \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043a\u0442\u043e \u0443\u0433\u043e\u0434\u043d\u043e, \u0434\u043b\u044f SaaS-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432\u0430\u0436\u043d\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0446\u0435\u043d\u043a\u0430 \u0432 \u044d\u0442\u043e\u043c \u0442\u0435\u0441\u0442\u0435 \u0431\u044b\u043b\u0430 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439. \u041e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86702,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86701","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00cembun\u0103t\u0103\u021birea parametrilor de securitate a conexiunii SSL \u00een Zimbra Collaboration Suite Open-Source Edition | ProHoster","description":"Fiabilitatea cript\u0103rii este unul dintre cele mai importante indicatori la utilizarea sistemelor informa\u021bionale pentru afaceri, deoarece zilnic acestea particip\u0103 la transmiterea unei cantit\u0103\u021bi enorme de informa\u021bii confiden\u021biale.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 SSL-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0432 Zimbra Collaboration Suite Open-Source Edition | ProHoster","og:description":"\u041d\u0430\u0434\u0435\u0436\u043d\u043e\u0441\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u0445 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u0431\u0438\u0437\u043d\u0435\u0441\u0430, \u0432\u0435\u0434\u044c \u0435\u0436\u0435\u0434\u043d\u0435\u0432\u043d\u043e \u043e\u043d\u0438 \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-28T17:42:14+00:00","article:modified_time":"2020-06-28T17:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86701","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:09:18","updated":"2026-02-19 09:14:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/86701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=86701"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/86701\/revisions"}],"predecessor-version":[{"id":161810,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/86701\/revisions\/161810"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/86702"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=86701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=86701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=86701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}