nginx禁用3DES和DES弱加密算法，保证SSL证书安全 SSL/TLS协议信息泄露漏洞(CVE-2016-2183)
cp -r nginx-1.19.2 ./nginx-1.19.2.bak
查看完旧版本信息可以执行如下命令，给旧版本改个名
mv ./nginx ./nginx.old
漏洞名称
SSL/TLS协议信息泄露漏洞(CVE-2016-2183)【原理扫描】
详细描述
TLS是安全传输层协议，用于在两个通信应用程序之间提供保密性和数据完整性。
TLS, SSH, IPSec协商及其他产品中使用的DES及Triple DES密码或者3DES及Triple 3DES存在大约四十亿块的生日界，这可使远程攻击者通过Sweet32攻击，获取纯文本数据。
{
listen 80;
listen 443 ssl https2;
#使用HTTP/2，需要Nginx1.9.7以上的版本
ssl on;
server_name http://ykqi.cn www.ykqi.cn;
index index.php index.html index.htm default.php default.htm default.html;
root /www/wwwroot/dist/ykqi;
#SSL-START SSL相关配置，请勿删除或修改下一行带注释的404规则
#error_page 404/404.html;
add_header X-Frame-Options DENY;
#禁止被嵌入框架
add_header X-Content-Type-Options nosniff;
#防止在IE9、Chrome和Safari中的MIME类型混淆攻击
ssl_certificate /www/server/panel/vhost/ssl/1_ykqi_bundle.crt;
ssl_certificate_key /www/server/panel/vhost/ssl/2_ykqi.key;
#SSL证书文件位置
ssl_dhparam /www/server/panel/vhost/ssl/dhparam.pem;
#DH-Key交换**文件位置
#SSL优化配置
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
#只允许TLS协议
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
或者
我的选择
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!3DES:!ADH:!RC4:!DH:!DHE;
#加密套件,这里用了CloudFlares Internet facing SSL cipher configuration
ssl_prefer_server_ciphers on;
.......此处省略
配置完重新启动Nginx!
通过命令： nmap -sV --script ssl-enum-ciphers -p 443 www.example.com 可得：
Starting Nmap 6.40 ( http://nmap.org ) at 2021-10-08 14:51 CST
Nmap scan report for 127.0.0.1
Host is up (0.035s latency).
PORT STATE SERVICE VERSION
443/tcp open http nginx 1.19.10
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - strong
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - strong
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 - strong
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - strong
| TLS_ECDHE_RSA_WITH_RC4_128_SHA - strong
| TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA - broken
| TLS_ECDH_anon_WITH_AES_128_CBC_SHA - broken
| TLS_ECDH_anon_WITH_AES_256_CBC_SHA - broken
| TLS_ECDH_anon_WITH_RC4_128_SHA - broken
| TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 - weak
| TLS_RSA_EXPORT_WITH_RC4_40_MD5 - weak
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_AES_256_CBC_SHA - strong
| TLS_RSA_WITH_AES_256_CBC_SHA256 - strong
| TLS_RSA_WITH_AES_256_GCM_SHA384 - strong
| TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong
| compressors:
| NULL
|_ least strength: strong
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.09 seconds
结果中weak(柔弱的)、broken(损坏的)、strong(坚固的)字段表示加密强度，为了安全需要将128位以下弱加密算法禁用，Nginx 配置 SSL需明确指定算法：
重启是nginx.conf配置生效
nginx -s reload
