mirror of
https://github.com/internetstandards/toolbox-wiki.git
synced 2026-07-21 11:37:40 +02:00
Fixed typos, updated example configs
This commit is contained in:
Wouter Kobes
@@ -1,48 +0,0 @@
|
||||
This document lists the basic usage of commonly used DNS records. It can be used to track commonly made mistakes.
|
||||
|
||||
# A
|
||||
* Points to an IPv4 address.
|
||||
* Does not point to anything else.
|
||||
* Record does not start (left side) with _ or -.
|
||||
|
||||
# AAAA
|
||||
* Points to an IPv6 address.
|
||||
* Does not point to anyhting else.
|
||||
* Record does not start (left side) with _ or -.
|
||||
|
||||
# MX
|
||||
* Used to specify a mailserver.
|
||||
* Contains a hostname, which in turn points to one or multiple A and/or AAAA records.
|
||||
* Preferrably does not point to other record types, but the use of CNAME records is seen in practice. RFC's are inconsistent on this.
|
||||
* Has a priority value.
|
||||
|
||||
# CNAME
|
||||
* Redirects to other DNS name with its own records (A, AAAA, CNAME).
|
||||
* Be careful with CNAME chaining; don't use too many CNAMEs in a row.
|
||||
|
||||
# CAA
|
||||
* Used to allowlist Certification Authorities that may issue certificates.
|
||||
* May contain several policies, like issue, issuewild (wildcard), issuemail (S/MIME certificates) and issuevmc (BIMI certificates).
|
||||
|
||||
# SRV
|
||||
* Records starts (left side) with _.
|
||||
* Points to an A and/or AAAA record.
|
||||
* Has a priority value.
|
||||
|
||||
# NS
|
||||
* Used to specify a nameserver.
|
||||
* Contains a hostname, which in turn points tp one or multiple A and/or AAAA records.
|
||||
|
||||
# SOA
|
||||
* Mandatory for every DNS zone.
|
||||
* Contains the following information (seperated by a single white space):
|
||||
* FQDN of the primary name server followed by a trailing dot.
|
||||
* e-mail address of the DNS administrator (followed by a trailing dot, the @ replaced with a dot and other dots escaped using a backslash).
|
||||
* an opening round bracket "(".
|
||||
* serial number that is changed (increased) on every zone change.
|
||||
* refresh time (in seconds) for a secondary name server to check the primairy name server for changes in the zone.
|
||||
* retry time (in seconds) for a secondary name server for requesting the serial number when the primary name server did not respond on the previous request.
|
||||
* expire time (in seconds) after which a secondary name server should stop answering requests if the primary name server is not responding.
|
||||
* Negative caching time to live (in seconds) which is the time a caching name server should cache a negative result (indicating that a name does not exist) coming from the authorative name server before trying again.
|
||||
* a closing round bracket ")".
|
||||
|
||||
@@ -1,100 +0,0 @@
|
||||
<img align="right" src="/images/logo-internetnl-en.svg">
|
||||
|
||||
# Ngnix example configuration
|
||||
This example configuration was created by SIDN Labs and shows how to configure Ngnix in order to score 100% in the Website test on Internet.nl.
|
||||
|
||||
# Assumptions
|
||||
* DNSSEC is used
|
||||
* IPv6 is used
|
||||
|
||||
# Configuring Ngnix
|
||||
|
||||
server_tokens off;
|
||||
add_header X-Frame-Options SAMEORIGIN;
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
add_header Strict-Transport-Security "max-age=31536000" always;
|
||||
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'" always;
|
||||
add_header Referrer-Policy "strict-origin" always;
|
||||
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/example.nl/fullchain.pem;
|
||||
|
||||
# Rate limiting 20 requests/s
|
||||
limit_req_zone $binary_remote_addr zone=mylimit:10m rate=20r/s;
|
||||
|
||||
# http://example.nl -> https://example.nl
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name example.nl;
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://example.nl$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
# http://(www|api).example.nl -> https://(www|api).example.nl
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name www.example.nl api.example.nl;
|
||||
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# https://example.nl -> https://www.example.nl
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name example.nl;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/example.nl/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/example.nl/privkey.pem;
|
||||
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_tickets on;
|
||||
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
return 301 https://www.$host$request_uri;
|
||||
}
|
||||
|
||||
# serve https://(www|api).example.nl
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name www.example.nl api.example.nl;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/example.nl/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/example.nl/privkey.pem;
|
||||
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_tickets on;
|
||||
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
# Example location for a Flask application running on port 8080
|
||||
location / {
|
||||
limit_req zone=mylimit burst=100 nodelay;
|
||||
|
||||
include uwsgi_params;
|
||||
uwsgi_pass flask:8080;
|
||||
uwsgi_ignore_client_abort on;
|
||||
}
|
||||
}
|
||||
@@ -1,75 +0,0 @@
|
||||
<img align="right" src="/images/logo-internetnl-en.svg">
|
||||
|
||||
# UNDER CONSTRUCTION!!!
|
||||
|
||||
# STARTTLS how-to
|
||||
This how-to is created by the Dutch Internet Standards Platform (the organization behind [internet.nl](https://internet.nl)) and is meant to provide practical information and guidance on implementing STARTTLS.
|
||||
|
||||
# Table of contents
|
||||
Under construction
|
||||
|
||||
# What is STARTTLS?
|
||||
Under construction
|
||||
|
||||
# Why use STARTTLS?
|
||||
Under construction
|
||||
|
||||
# Tips, tricks and notices for implementation
|
||||
* http://postfix.1071664.n5.nabble.com/Disable-SSL-TLS-renegotiation-td96864.html#a96871
|
||||
* Use the RFC 7919 defined DH groups: https://raw.githubusercontent.com/internetstandards/dhe_groups/main/ffdhe4096.pem)
|
||||
|
||||
## Implementing STARTTLS in Postfix
|
||||
**Specifics for this setup**
|
||||
* Linux Debian 10 (Buster)
|
||||
* Postfix 3.4.5
|
||||
* OpenSSL 1.1.1d
|
||||
|
||||
**Assumptions**
|
||||
* Mail server is using DANE
|
||||
* Software packages are already installed
|
||||
|
||||
### Configuring Postfix
|
||||
|
||||
# use DANE (when acting as a client)
|
||||
smtp_dns_support_level = dnssec
|
||||
smtp_tls_security_level = dane
|
||||
smtp_host_lookup = dns
|
||||
smtp_tls_note_starttls_offer = yes
|
||||
|
||||
# --- TLS settings ---
|
||||
smtpd_tls_security_level = may
|
||||
smtpd_tls_key_file = /etc/postfix/ssl/example.nl.key
|
||||
smtpd_tls_cert_file = /etc/postfix/ssl/example.nl.crt
|
||||
smtpd_tls_CAfile = /etc/postfix/ssl/example.nl-cabundle.crt
|
||||
smtpd_tls_received_header = yes
|
||||
smtpd_tls_session_cache_timeout = 3600s
|
||||
|
||||
# --- TLS protocol config ---
|
||||
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
||||
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
||||
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
||||
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
||||
lmtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
||||
lmtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
||||
|
||||
# --- TLS cipher config ---
|
||||
smtpd_tls_mandatory_ciphers=high
|
||||
smtpd_tls_ciphers=high
|
||||
# disable compression and client-initiated renegotiation
|
||||
tls_ssl_options = NO_COMPRESSION, 0x40000000
|
||||
# disable unsecure ciphers
|
||||
smtpd_tls_exclude_ciphers = EXP, LOW, MEDIUM, aNULL, eNULL, SRP, PSK, kDH, ADH, AECDH, kRSA, DSS, RC4, DES, IDEA, SEED, ARIA, AESCCM8, 3DES, MD5
|
||||
smtp_tls_exclude_ciphers = EXP, LOW, MEDIUM, aNULL, eNULL, SRP, PSK, kDH, ADH, AECDH, kRSA, DSS, RC4, DES, IDEA, SEED, ARIA, AESCCM8, 3DES, MD5
|
||||
# Enable server cipher-suite preferences
|
||||
tls_preempt_cipherlist = yes
|
||||
# Forward secrecy
|
||||
smtpd_tls_eecdh_grade=ultra
|
||||
smtpd_tls_dh1024_param_file = /etc/postfix/ssl/ffdhe4096.pem
|
||||
|
||||
# --- TLS logging ---
|
||||
smtp_tls_loglevel = 1
|
||||
smtpd_tls_loglevel = 1
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
<img align="right" src="/images/logo-internetnl-en.svg">
|
||||
|
||||
# Webserver example configurations
|
||||
|
||||
## Common mistakes
|
||||
|
||||
For all webservers, we observe the following common mistakes:
|
||||
|
||||
* HTTPS redirect: our test demands an upgrade to HTTPS **first**, before redirecting. This means that when you want your website to be accessible over domain example.nl, we expect http://example.nl to redirect to https://example.nl, while http://www.example.nl should redirect first to https://www.example.nl, then to https://example.nl. The reason for this, is that HSTS will only work when the Strict-Transport-Security header is served over HTTPS. By redirecting directly, the initial domain is not protected by HSTS.
|
||||
* SHA-1 as hash function for key exchange: this is a legacy hash function that is explicitly deprecated since 2021 by [RFC 9155](https://datatracker.ietf.org/doc/html/rfc9155) and insufficient according to the latest TLS guidelines. Note that this is a different setting than the accepted ciphers. Not all firmware (especially GUI firmware) allows you easily change this configuration.
|
||||
|
||||
## nginx example configuration
|
||||
The most actual example configuration can be found within the source code of Internet.nl itself.
|
||||
|
||||
### Assumptions
|
||||
* DNSSEC is enabled
|
||||
* IPv6 is used and working
|
||||
* RPKI is used for all IPs
|
||||
|
||||
### Configuring nginx
|
||||
|
||||
The configuration used by Internet.nl is to be found in [this folder](https://github.com/internetstandards/Internet.nl/blob/main/docker/webserver/).
|
||||
Parts of the configuration can be reused by your project to set up a 100% compliant webserver.
|
||||
|
||||
Most of the generic configuration can be found [here](https://github.com/internetstandards/Internet.nl/blob/main/docker/webserver/nginx_templates/default.conf.template). Most notable are
|
||||
enabling HTTP3 and upgrading HTTP requests to HTTPS. Note that for the Internet.nl project specific configurations are made, for instance for the connection test.
|
||||
You will not need this for an ordinary webserver configuration.
|
||||
|
||||
For the TLS configuration, check [this file](https://github.com/internetstandards/Internet.nl/blob/main/docker/webserver/nginx_templates/tls.conf.template).
|
||||
Note that this allows TLS 1.2 and TLS 1.3, with all sufficient/good ciphers. `ssl_conf_command SignatureAlgorithms` ensures only sufficient signature
|
||||
algorithms are accepted by the server (in case you got a 'SHA-1' finding in this test). Make sure to uncomment `ssl_stapling` and `ssl_stapling_verify` if your
|
||||
CA/certificate still supports OCSP to enable OCSP-stapling.
|
||||
|
||||
For HTTP headers, [this configuration](https://github.com/internetstandards/Internet.nl/blob/main/docker/webserver/http.headers) includes general headers, [here](https://github.com/internetstandards/Internet.nl/blob/main/docker/webserver/hsts_h3.headers) HSTS (Strict-Transport-Security) and HTTP3 headers are included. [This file](https://github.com/internetstandards/Internet.nl/blob/main/docker/webserver/nginx_templates/csp.header.template) contains an example Content-Security-Policy (CSP) header, which should be adapted to your own website.
|
||||
|
||||
|
||||
## Apache
|
||||
|
||||
We currently do not have a full example Apache configuration. Most settings are documented [here](https://httpd.apache.org/docs/current/mod/mod_ssl.html), for example the `SSLCipherSuite` setting to specify which cipher suites should be accepted.
|
||||
|
||||
To make sure only the allowed hash functions for key exchange are used, make use of the following setting:
|
||||
|
||||
`SSLOpenSSLConfCmd SignatureAlgorithms ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA256:RSA+SHA256:RSA+SHA384:RSA+SHA512`
|
||||
Reference in New Issue
Block a user