View Issue Details

Related ChangesetsJump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0000122bareos-coreGeneralpublic2013-03-05 17:222015-03-25 19:19
Reportermvwieringen Assigned To 
PrioritynormalSeverityfeatureReproducibilityN/A
Status closedResolutionfixed 
PlatformOpenIndianaOSOpenIndianaOS Versionb151a
Product Version13.1.0 
Fixed in Version13.1.0 
Summary0000122: Allow for relaxed TLS configuration.
DescriptionCurrent the verify_peer flag is hardcoded to true for the console programs.
It would be nice if we would allow a somewhat relaxed TLS mode that allows
to establish a TLS connection without the need for very strict certificate
checking which is done now. The default setting is the same as before but
the administrator can relax this setting by setting the "TLS Verify Peer"
option to false in a definition of the client connection.
TagsNo tags attached.

Activities

mvwieringen

mvwieringen

2013-03-05 17:33

developer   ~0000236

This doesn't have severe security implications as the authorization with
challenge response (md5 hashes) is done before the TLS handshake. So this
means you can have the same security as a non TLS connection but with a
relaxed config which means you get a encrypted datastream even when you
haven't put the whole certificate enrollment in place e.g. CA certificate
and potentially client certificates. Protocols like LDAPS and ESMTP also
allow this.
mvwieringen adm

mvwieringen adm

2013-08-13 03:12

administrator   ~0000606

Fix committed to bareos master branch with changesetid 740.
mvwieringen

mvwieringen

2015-03-25 16:51

developer   ~0001424

Fix committed to bareos2015 bareos-13.2 branch with changesetid 4296.
joergs

joergs

2015-03-25 19:19

developer   ~0001574

Due to the reimport of the Github repository to bugs.bareos.org, the status of some tickets have been changed. These tickets will be closed again.
Sorry for the noise.

Related Changesets

bareos: master 26ae9991

2013-05-04 21:11

mvwieringen adm

Ported: N/A

Details Diff		 Allow for relaxed TLS configuration.

Current the verify_peer flag is hardcoded to true for the console
programs. It would be nice if we would allow a somewhat relaxed
TLS mode that allows to establish a TLS connection without the
need for very strict certificate checking which is done now. The
default setting is the same as before but the administrator can
relax this setting by setting the "TLS Verify Peer" option to
false in a definition of the client connection.

This doesn't have severe security implications as the authorization
with challenge response (md5 hashes) is done before the TLS handshake.
So this means you can have the same security as a non TLS connection
but with a relaxed config which means you get a encrypted datastream
even when you haven't put the whole certificate enrollment in place
e.g. CA certificate and potentially client certificates. Protocols
like LDAPS and ESMTP also allow this.

This is also the first version of the GNUTLS code that allows an
TLS encrypted session with the GNUTLS library as a replacement for
the openssl code. This currently is only tested with the relaxed
TLS configuration options set e.g. TLS Verify Peer = no

Fixes 0000122: Allow for relaxed TLS configuration.		 Affected Issues
0000122
mod - src/stored/stored_conf.h Diff File
mod - src/qt-console/bcomm/dircomm.cpp Diff File
mod - src/qt-console/bat_conf.h Diff File
mod - src/qt-console/bat_conf.cpp Diff File
mod - src/lib/tls_openssl.c Diff File
mod - src/lib/tls_nss.c Diff File
mod - src/lib/tls_gnutls.c Diff File
mod - src/filed/filed_conf.h Diff File
mod - src/filed/filed_conf.c Diff File
mod - src/filed/filed.c Diff File
mod - src/dird/dird_conf.h Diff File
mod - src/console/console_conf.h Diff File
mod - src/console/console_conf.c Diff File
mod - src/console/console.c Diff File
mod - autoconf/configure.in Diff File

bareos2015: bareos-13.2 fba7f87c

2013-05-04 23:11

mvwieringen

Ported: N/A

Details Diff		 Allow for relaxed TLS configuration.

Current the verify_peer flag is hardcoded to true for the console
programs. It would be nice if we would allow a somewhat relaxed
TLS mode that allows to establish a TLS connection without the
need for very strict certificate checking which is done now. The
default setting is the same as before but the administrator can
relax this setting by setting the "TLS Verify Peer" option to
false in a definition of the client connection.

This doesn't have severe security implications as the authorization
with challenge response (md5 hashes) is done before the TLS handshake.
So this means you can have the same security as a non TLS connection
but with a relaxed config which means you get a encrypted datastream
even when you haven't put the whole certificate enrollment in place
e.g. CA certificate and potentially client certificates. Protocols
like LDAPS and ESMTP also allow this.

This is also the first version of the GNUTLS code that allows an
TLS encrypted session with the GNUTLS library as a replacement for
the openssl code. This currently is only tested with the relaxed
TLS configuration options set e.g. TLS Verify Peer = no

Fixes 0000122: Allow for relaxed TLS configuration.		 Affected Issues
0000122
mod - autoconf/configure.in Diff File
mod - src/console/console.c Diff File
mod - src/console/console_conf.c Diff File
mod - src/console/console_conf.h Diff File
mod - src/dird/dird_conf.h Diff File
mod - src/filed/filed.c Diff File
mod - src/filed/filed_conf.c Diff File
mod - src/filed/filed_conf.h Diff File
mod - src/lib/tls_gnutls.c Diff File
mod - src/lib/tls_nss.c Diff File
mod - src/lib/tls_openssl.c Diff File
mod - src/qt-console/bat_conf.cpp Diff File
mod - src/qt-console/bat_conf.h Diff File
mod - src/qt-console/bcomm/dircomm.cpp Diff File
mod - src/stored/stored_conf.h Diff File

Issue History

Date Modified Username Field Change
2013-03-05 17:22 mvwieringen New Issue
2013-03-05 17:33 mvwieringen Note Added: 0000236
2013-03-07 09:55 mvwieringen Changeset attached => bareos master 2ae7ad99
2013-03-07 09:55 mvwieringen Assigned To => mvwieringen
2013-03-07 09:55 mvwieringen Status new => closed
2013-03-07 09:55 mvwieringen Resolution open => fixed
2013-03-07 09:56 mvwieringen Assigned To mvwieringen =>
2013-03-07 09:56 mvwieringen Fixed in Version => 13.1.0
2013-05-24 12:52 pstorz Assigned To => pstorz
2013-05-24 12:52 pstorz Status closed => resolved
2013-07-04 12:53 pstorz Status resolved => closed
2013-08-13 03:12 mvwieringen adm Changeset attached => bareos master 26ae9991
2013-08-13 03:12 mvwieringen adm Note Added: 0000606
2013-08-13 03:12 mvwieringen adm Assigned To pstorz => mvwieringen adm
2013-08-13 03:12 mvwieringen adm Status closed => resolved
2013-08-13 09:15 mvwieringen adm Assigned To mvwieringen adm =>
2013-08-13 09:15 mvwieringen adm Status resolved => closed
2015-03-25 16:51 mvwieringen Changeset attached => bareos2015 bareos-13.2 fba7f87c
2015-03-25 16:51 mvwieringen Note Added: 0001424
2015-03-25 16:51 mvwieringen Status closed => resolved
2015-03-25 19:19 joergs Note Added: 0001574
2015-03-25 19:19 joergs Status resolved => closed