ejabberd: define cifras de Diffie-Hellman (DH) bitsize para = 2048

Question

Na versão moderna de ejabberd , existe a possibilidade de usar parâmetros personalizados do Diffie-Helman fornecendo um arquivo-pem auto-gerado para as opções dhfile e s2s_dhfile em ejabberd.yml . Eu tinha criado diferentes tais parâmetros DH pem-arquivos de três maneiras diferentes:

openssl dhparam -out dh.pem 2048
openssl dhparam -out dh.pem 4096
openssl genpkey -genparam -algorithm DH -out dhp4096.pem -pkeyopt dh_paramgen_prime_len:4096

colocou-os em /etc/ejabberd/ e configurou o ejabberd de acordo:

hosts:
  - "somehost.tld"

access:
  announce:
    admin: allow
  c2s:
    blocked: deny
    all: allow
  c2s_shaper:
    admin: none
    all: normal
  configure:
    admin: allow
  local:
    local: allow
  max_user_offline_messages:
    admin: 100
    all: 100
  max_user_sessions:
    all: 10
  muc:
    all: allow
  muc_admin:
    admin: allow
  pubsub_createnode:
    all: allow
  register:
    all: allow
  s2s:
    all: allow
  s2s_shaper:
    all: fast

acl:
  admin:
    user:
      -
        "admin": "somehost.tld"
  local:
    user_regexp:
      - ""

  blocked:
    user:
      - "reklama": "sj.ms"
      - "cc6523": "tigase.im"
      - "reklama403": "kdetalk.net"
      - "pp241331": "kdetalk.net"
      - "advertising": "bin.vc"
      - "swiped_su6070": "debianforum.de"

auth_method: odbc
odbc_database: "ejabberd"
odbc_keepalive_interval: 3600
odbc_password: "YZucuq3vSdfPDnzs"
odbc_port: 3306
odbc_server: "127.0.0.1"
odbc_type: mysql
odbc_username: "ejabberdusr"

captcha_cmd: "/usr/lib/x86_64-linux-gnu/ejabberd/priv/bin/captcha.sh"
captcha_host: "http://somehost.tld:5280"
captcha_limit: 5

language: "en"

define_macro:
  'TLS_CIPHERS': "ECDH:DH:!CAMELLIA128:!3DES:!MD5:!RC4:!aNULL:!NULL:!EXPORT:!LOW:!MEDIUM"

listen:
  -
    port: 5222
    module: ejabberd_c2s
    certfile: "/etc/ejabberd/cert/somehost.tld.pem"
    dhfile: "/etc/ejabberd/dhp4096.pem"
    starttls: true
    starttls_required: true
    stream_management: true
    max_ack_queue: 1000
    resend_on_timeout: true
    max_stanza_size: 65536
    shaper: c2s_shaper
    access: c2s
    protocol_options:
      - "no_sslv3"
    ciphers: 'TLS_CIPHERS'
    resend_on_timeout: if_offline
    zlib: true
  -
    port: 5269
    module: ejabberd_s2s_in
    transport: tcp
    max_stanza_size: 131072
    shaper: s2s_shaper
  -
    port: 5280
    module: ejabberd_http
    web_admin: true
    captcha: true

loglevel: 2
max_fsm_queue: 1000

modules:
  mod_adhoc: []

  mod_announce:
    access: announce

  mod_blocking: {} # requires mod_privacy
  mod_caps: []
  mod_carboncopy: {}
  mod_configure: []
##  mod_admin_extra: []
  mod_disco: []
  mod_irc: []
  mod_last: []

  mod_muc:
    host: "muc.@HOST@"
    access: all
    access_create: all
    access_persistent: all
    access_admin: muc_admin
    max_users: 500
    history_size: 1000
    default_room_options:
      allow_change_subj: true
      allow_private_messages: true
      allow_private_messages_from_visitors: anyone
      allow_query_users: false
      allow_user_invites: true
      allow_visitor_nickchange: true
      allow_visitor_status: true
      anonymous: false
      captcha_protected: false
      logging: true
      max_users: 200
      members_by_default: true
      members_only: false
      moderated: false
      password_protected: false
      persistent: false
      public: true
      public_list: true

  mod_muc_log:
    access_log: muc_admin
    dirname: room_name
    dirtype: subdirs
    file_format: html
    outdir: "/var/www/muc"
    spam_prevention: false
    timezone: local
    top_link:
      "/": "Jedem das Seine."

  mod_offline:
    access_max_user_messages: max_user_offline_messages

  mod_ping: {}
  mod_privacy: []
  mod_private: []
##  mod_proxy65:
##    access: all
##    shaper: c2s_shaper
  mod_pubsub:
    access_createnode: pubsub_createnode
    pep_sendlast_offline: false
    last_item_cache: false
    plugins:
      - "flat"
      - "hometree"
      - "pep"

  mod_register:
    welcome_message:
      subject: "Welcome!"
      body: "Welcome"
    captcha_protected: true
    access: register

  mod_roster: []
  mod_shared_roster: {}
  mod_stats: []
  mod_time: []
  mod_vcard: []
  mod_version: []

  mod_mam:
    db_type: odbc
    default: never

registration_timeout: 600
outgoing_s2s_port: 5269
outgoing_s2s_timeout: 10000
s2s_access: s2s
s2s_certfile: "/etc/ejabberd/cert/somehost.tld.pem"
s2s_dhfile: "/etc/ejabberd/dhp4096.pem"
s2s_use_starttls: required
s2s_protocol_options:
  - "no_sslv3"
s2s_ciphers: 'TLS_CIPHERS'
shaper:
  normal: 1000
  fast: 50000
watchdog_admins:
  - []
auth_password_format: plain
fqdn: "somehost.tld"

Nenhum desses arquivos do DH-params funcionou. A ferramenta XMPP.net tester ainda avisa que:

Server uses Diffie-Hellman parameters of < 2048 bits. Grade capped to B.

e na seção "Cifras", há 1024 bitsize de fato, não 2048 ou 4096 :

ÉissoeueminhaconfiguraçãoouestaéaferramentaXMPP.net?ComoeumesmoverificootamanhodobitDH?

OservidorrodaoDebian8.2"Jessie" ( Stable ) e ejabberd 15.09 do repositório Testando .

    

Answer 1

O culpado é encontrado: os parâmetros Diffie-Hellman são controlados por erlang-p1-tls . Então, quando você atualizar ejabberd para a versão do repositório testing , você deve atualizar o pacote erlang-p1-tls para a versão do teste também!

sudo apt-get install erlang-p1-tls/testing

Na verdade, para que a versão stable do ejabberd funcione corretamente no stable Debian, atualize todos os pacotes erlang-* para as versões testing também.