{"id":86701,"date":"2020-06-28T19:42:14","date_gmt":"2020-06-28T17:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition"},"modified":"2020-06-28T19:42:14","modified_gmt":"2020-06-28T17:42:14","slug":"uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","title":{"rendered":"F\u00f6rb\u00e4ttring av s\u00e4kerhetsparametrar f\u00f6r SSL-anslutning i Zimbra Collaboration Suite Open-Source Edition","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Krypteringsp\u00e5litlighet \u00e4r en av de viktigaste indikatorerna vid anv\u00e4ndning av informationssystem f\u00f6r f\u00f6retag, eftersom de dagligen hanterar stora m\u00e4ngder konfidentiell information. Ett allm\u00e4nt vedertaget medel f\u00f6r att utv\u00e4rdera kvaliteten p\u00e5 en SSL-anslutning \u00e4r det oberoende testet fr\u00e5n Qualys SSL Labs. Eftersom detta test kan genomf\u00f6ras av vem som helst, \u00e4r det s\u00e4rskilt viktigt f\u00f6r SaaS-leverant\u00f6rer att uppn\u00e5 den h\u00f6gsta m\u00f6jliga bed\u00f6mningen i detta test. Ocks\u00e5 vanliga f\u00f6retag bryr sig om kvaliteten p\u00e5 SSL-anslutningen. F\u00f6r dem utg\u00f6r detta test ett utm\u00e4rkt tillf\u00e4lle att identifiera potentiella s\u00e5rbarheter och i f\u00f6rv\u00e4g st\u00e4nga alla bakd\u00f6rrar f\u00f6r cyberbrottslingar.<\/p>\n

\"F\u00f6rb\u00e4ttring<\/a><\/noindex>
\nI Zimbra OSE \u00e4r det till\u00e5tet att anv\u00e4nda tv\u00e5 typer SSL-certifikat<\/a>. Den f\u00f6rsta \u00e4r ett sj\u00e4lvsignerat certifikat som automatiskt l\u00e4ggs till vid installationen. Detta certifikat \u00e4r gratis och har inga begr\u00e4nsningar f\u00f6r anv\u00e4ndningstid, vilket g\u00f6r det perfekt f\u00f6r testning av Zimbra OSE eller f\u00f6r anv\u00e4ndning enbart inom ett internt n\u00e4tverk. Men n\u00e4r anv\u00e4ndare g\u00e5r in i webbklienten kommer de att se en varning fr\u00e5n webbl\u00e4saren att detta certifikat inte \u00e4r p\u00e5litligt, och testet fr\u00e5n Qualys SSL Labs kommer definitivt att misslyckas f\u00f6r din server.<\/p>\n

Den andra \u00e4r ett kommersiellt SSL-certifikat som \u00e4r signerat av en certifieringsmyndighet. S\u00e5dana certifikat accepteras utan problem av webbl\u00e4sare och anv\u00e4nds vanligtvis vid kommersiell drift av Zimbra OSE. Direkt efter korrekt installation av det kommersiella certifikatet visar Zimbra OSE 8.8.15 betyget A i testet fr\u00e5n Qualys SSL Labs. Detta \u00e4r ett utm\u00e4rkt resultat, men v\u00e5rt m\u00e5l \u00e4r att uppn\u00e5 betyget A+.<\/p>\n

\"F\u00f6rb\u00e4ttring
\n
\n\"F\u00f6rb\u00e4ttring
\n
\nF\u00f6r att uppn\u00e5 det maximala betyget i testet fr\u00e5n Qualys SSL Labs vid anv\u00e4ndning av Zimbra Collaboration Suite Open-Source Edition m\u00e5ste en rad steg vidtas:<\/p>\n

1. \u00d6ka parametrarna f\u00f6r Diffie-Hellman-protokollet<\/b><\/p>\n

Som standard har alla komponenter i Zimbra OSE 8.8.15 som anv\u00e4nder OpenSSL en parameter f\u00f6r Diffie-Hellman-protokollet p\u00e5 2048 bitar. I princip \u00e4r detta mer \u00e4n tillr\u00e4ckligt f\u00f6r att f\u00e5 en A+ i testet fr\u00e5n Qualys SSL Labs. Men om du uppgraderar fr\u00e5n \u00e4ldre versioner kan parametrarna vara l\u00e4gre. D\u00e4rf\u00f6r rekommenderas det att efter uppgraderingen k\u00f6ra kommandot zmdhparam set -new 2048, vilket h\u00f6jer Diffie-Hellman-parametrarna till acceptabla 2048 bitar, och vid behov kan detta kommando ocks\u00e5 h\u00f6ja parametrarna till 3072 eller 4096 bitar, vilket \u00e5 ena sidan kommer att \u00f6ka genereringstiden, men \u00e5 andra sidan kommer att ha en positiv inverkan p\u00e5 s\u00e4kerhetsniv\u00e5n f\u00f6r e-postservern.<\/p>\n

2. Aktivering av den rekommenderade listan \u00f6ver anv\u00e4nda kryptoalgoritmer<\/b><\/p>\n

Som standard st\u00f6der Zimbra Collaboration Suite Open-Source Edition ett brett utbud av starka och svaga kryptoalgoritmer som anv\u00e4nds f\u00f6r att kryptera data som passerar genom s\u00e4krade anslutningar. Men anv\u00e4ndning av svaga kryptoalgoritmer \u00e4r en allvarlig nackdel vid s\u00e4kerhetskontrollen av SSL-anslutningen. F\u00f6r att undvika detta \u00e4r det n\u00f6dv\u00e4ndigt att konfigurera listan \u00f6ver anv\u00e4nda kryptoalgoritmer.<\/p>\n

F\u00f6r detta \u00e4ndam\u00e5l b\u00f6r f\u00f6ljande kommando anv\u00e4ndas zmprov mcf zimbraReverseProxySSLCiphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4'<\/code><\/p>\n

Detta kommando inkluderar omedelbart den rekommenderade upps\u00e4ttningen av kryptoalgoritmer, och genom detta kommando kan du direkt inkluderade s\u00e4kra kryptoalgoritmer och utesluta os\u00e4kra. Nu \u00e5terst\u00e5r bara att omstarta noder med omv\u00e4nd proxy med hj\u00e4lp av kommandot zmproxyctl restart. Efter omstarten tr\u00e4der de gjorda \u00e4ndringarna i kraft.<\/p>\n

Om denna lista av n\u00e5gon anledning inte tillfredsst\u00e4ller dig kan du ta bort n\u00e5gra svaga kryptoalgoritmer med kommandot zmprov mcf +zimbraSSLExcludeCipherSuites<\/code>. S\u00e5 till exempel kan kommandot zmprov mcf +zimbraSSLExcludeCipherSuites TLS_RSA_WITH_RC4_128_MD5 +zimbraSSLExcludeCipherSuites TLS_RSA_WITH_RC4_128_SHA +zimbraSSLExcludeCipherSuites SSL_RSA_WITH_RC4_128_MD5 +zimbraSSLExcludeCipherSuites SSL_RSA_WITH_RC4_128_SHA +zimbraSSLExcludeCipherSuites TLS_ECDHE_RSA_WITH_RC4_128_SHA<\/code>, som helt utesluter anv\u00e4ndning av RC4-krypteringar. Detsamma kan g\u00f6ras med AES och 3DES-krypteringar.<\/p>\n

3. Aktivering av HSTS<\/b><\/p>\n

Aktiverade mekanismer f\u00f6r tvingad kryptering av anslutningar och \u00e5terst\u00e4llning av TLS-sessioner \u00e4r ocks\u00e5 obligatoriska villkor f\u00f6r att f\u00e5 h\u00f6gsta po\u00e4ng i testet fr\u00e5n Qualys SSL Labs. F\u00f6r att aktivera dem m\u00e5ste du ange kommandot zmprov mcf +zimbraResponseHeader "Strict-Transport-Security: max-age=31536000"<\/code>. Detta kommando l\u00e4gger till den n\u00f6dv\u00e4ndiga rubriken i konfigurationen, och f\u00f6r att de nya inst\u00e4llningarna ska tr\u00e4da i kraft m\u00e5ste Zimbra OSE startas om med hj\u00e4lp av kommandot zmcontrol restart<\/b>.<\/p>\n

Redan i detta skede kommer testet fr\u00e5n Qualys SSL Labs att visa betyget A+, men om du vill ytterligare f\u00f6rb\u00e4ttra s\u00e4kerheten p\u00e5 din server kan du vidta ytterligare \u00e5tg\u00e4rder.<\/p>\n

\"F\u00f6rb\u00e4ttring
\n
\nTill exempel kan du aktivera tvingad kryptering av mellanprocessanslutningar samt aktivera tvingad kryptering vid anslutning till Zimbra OSE-tj\u00e4nster. F\u00f6r att kontrollera mellanprocessanslutningar b\u00f6r f\u00f6ljande kommandon anges:<\/p>\n

zmlocalconfig -e ldap_starttls_supported=1\nzmlocalconfig -e zimbra_require_interprocess_security=1\nzmlocalconfig -e ldap_starttls_required=true<\/code><\/pre>\n
\nF\u00f6r att aktivera tvingad kryptering m\u00e5ste du ange:<\/p>\n
zmprov gs `zmhostname` zimbraReverseProxyMailMode\nzmprov ms `zmhostname` zimbraReverseProxyMailMode https\n\nzmprov gs `zmhostname` zimbraMailMode\nzmprov ms `zmhostname` zimbraMailMode https\n\nzmprov gs `zmhostname` zimbraReverseProxySSLToUpstreamEnabled\nzmprov ms `zmhostname` zimbraReverseProxySSLToUpstreamEnabled TRUE<\/code><\/pre>\n
Genom dessa kommandon kommer alla anslutningar till proxy-servrar<\/a> och e-postservrar att krypteras, och alla dessa anslutningar kommer att proxieras.<\/p>\n
\"F\u00f6rb\u00e4ttring
\n
\nS\u00e5ledes, genom att f\u00f6lja v\u00e5ra rekommendationer kan du inte bara uppn\u00e5 h\u00f6gsta betyg i SSL-s\u00e4kerhetstestet, utan ocks\u00e5 avsev\u00e4rt \u00f6ka s\u00e4kerheten i hela Zimbra OSE-infrastrukturen.<\/p>\n
F\u00f6r alla fr\u00e5gor relaterade till Zextras Suite kan ni kontakta f\u00f6retagets representant \"Zextras\", Ekaterina Triandafiliidi, via e-post katerina@zextras.com
\n
K\u00e4lla: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0430\u0434\u0435\u0436\u043d\u043e\u0441\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u0445 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u0431\u0438\u0437\u043d\u0435\u0441\u0430, \u0432\u0435\u0434\u044c \u0435\u0436\u0435\u0434\u043d\u0435\u0432\u043d\u043e \u043e\u043d\u0438 \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u041e\u0431\u0449\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u044b\u043c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043e\u0446\u0435\u043d\u043a\u0438 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0430 SSL-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0439 \u0442\u0435\u0441\u0442 \u043e\u0442 Qualys SSL Labs. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0439 \u0442\u0435\u0441\u0442 \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043a\u0442\u043e \u0443\u0433\u043e\u0434\u043d\u043e, \u0434\u043b\u044f SaaS-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432\u0430\u0436\u043d\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0446\u0435\u043d\u043a\u0430 \u0432 \u044d\u0442\u043e\u043c \u0442\u0435\u0441\u0442\u0435 \u0431\u044b\u043b\u0430 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439. \u041e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86702,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86701","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47F\u00f6rb\u00e4ttring av SSL-s\u00e4kerhetsparametrar i Zimbra Collaboration Suite Open-Source Edition | ProHoster","description":"Tillf\u00f6rlitligheten av kryptering \u00e4r en av de viktigaste indikatorerna vid anv\u00e4ndning av informationssystem f\u00f6r f\u00f6retag, eftersom de dagligen \u00e4r involverade i \u00f6verf\u00f6ring av enorma m\u00e4ngder konfidentiell information.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 SSL-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0432 Zimbra Collaboration Suite Open-Source Edition | ProHoster","og:description":"\u041d\u0430\u0434\u0435\u0436\u043d\u043e\u0441\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u0445 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u0431\u0438\u0437\u043d\u0435\u0441\u0430, \u0432\u0435\u0434\u044c \u0435\u0436\u0435\u0434\u043d\u0435\u0432\u043d\u043e \u043e\u043d\u0438 \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/uluchshenie-parametrov-bezopasnosti-ssl-soedineniya-v-zimbra-collaboration-suite-open-source-edition","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-28T17:42:14+00:00","article:modified_time":"2020-06-28T17:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86701","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:09:18","updated":"2026-02-19 09:14:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/86701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=86701"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/86701\/revisions"}],"predecessor-version":[{"id":161810,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/86701\/revisions\/161810"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/86702"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=86701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=86701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=86701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}