PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-30 11:29:01 +00:00
Code Issues Projects Releases Wiki Activity

Update cipher suites to eliminate anonymous authentication methods

Browse Source
This commit is contained in:
dmiller
2017-07-29 05:55:27 +00:00
parent cf56f93d95
commit 0d21bd42e2
6 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGELOG
View File

@@ -1,5 +1,9 @@
# Nmap Changelog ($Id$); -*-text-*-
o Updated the default ciphers list for Ncat and the secure ciphers list for
Nsock to use "!aNULL:!eNULL" instead of "!ADH". With the addition of ECDH
ciphersuites, anonymous ECDH suites were being allowed. [Daniel Miller]
o [NSE][GH#930] Fix ndmp-version and ndmp-fs-info when scanning Veritas Backup
Exec Agent 15 or 16. [Andrew Orr]

2
ncat/docs/ncat.xml
View File

@@ -392,7 +392,7 @@
when connecting to servers or when accepting SSL connections from
clients. The syntax is described in the OpenSSL ciphers(1) man
page, and defaults to
<literal>ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH</literal></para>
<literal>ALL:!aNULL:!eNULL:!LOW:!EXP:!MD5:@STRENGTH</literal></para>
</listitem>
</varlistentry>
</variablelist>

2
ncat/docs/ncatguide.xml
View File

@@ -440,7 +440,7 @@ Content-Type: text/html; charset=UTF-8
client) or accept (as a server) is a matter of choice between the greatest
compatibility and the greatest security. The default set, expressed as an
OpenSSL cipherlist, is
<literal>ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH</literal>, a reasonable balance
<literal>ALL:!aNULL:!eNULL:!LOW:!EXP:!MD5:@STRENGTH</literal>, a reasonable balance
between the two ends of the spectrum. To set a different priority or
initial choice, use the <option>--ssl-ciphers</option> option.
<indexterm><primary><option>--ssl-ciphers</option> (Ncat option)</primary></indexterm>

2
ncat/ncat_connect.c
View File

@@ -248,7 +248,7 @@ static void set_ssl_ctx_options(SSL_CTX *ctx)
bye("The --ssl-key and --ssl-cert options must be used together.");
}
if (o.sslciphers == NULL) {
if (!SSL_CTX_set_cipher_list(ctx, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"))
if (!SSL_CTX_set_cipher_list(ctx, "ALL:!aNULL:!eNULL:!LOW:!EXP:!MD5:@STRENGTH"))
bye("Unable to set OpenSSL cipher list: %s", ERR_error_string(ERR_get_error(), NULL));
}
else {

2
ncat/ncat_ssl.c
View File

@@ -197,7 +197,7 @@ SSL_CTX *setup_ssl_listen(void)
/* Secure ciphers list taken from Nsock. */
if (o.sslciphers == NULL) {
if (!SSL_CTX_set_cipher_list(sslctx, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"))
if (!SSL_CTX_set_cipher_list(sslctx, "ALL:!aNULL:!eNULL:!LOW:!EXP:!MD5:@STRENGTH"))
bye("Unable to set OpenSSL cipher list: %s", ERR_error_string(ERR_get_error(), NULL));
}
else {

2
nsock/src/nsock_ssl.c
View File

@@ -71,7 +71,7 @@
* OpenSSL. To see exactly what ciphers are enabled, use the command
* openssl ciphers -v '...'
* where ... is the string below. */
#define CIPHERS_SECURE "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"
#define CIPHERS_SECURE "ALL:!aNULL:!eNULL:!LOW:!EXP:!MD5:@STRENGTH"
/* This list of ciphers is for speed and compatibility, not security. Any cipher
* is accepted, and the list is sorted by speed based on Brian Hatch's