diff --git a/doc/testssl.1 b/doc/testssl.1 index f864770..f17a3ce 100644 --- a/doc/testssl.1 +++ b/doc/testssl.1 @@ -1,8 +1,8 @@ -.\" Automatically generated by Pandoc 3.8.2.1 +.\" Automatically generated by Pandoc 3.1.11.1 .\" -.TH "" "" "" "" +.TH "" "" "" "" "" .SS NAME -testssl.sh \(en check encryption of SSL/TLS servers +testssl.sh \[en] check encryption of SSL/TLS servers .SS SYNOPSIS \f[CR]testssl.sh [OPTIONS] \f[R], \f[CR]testssl.sh [OPTIONS] \-\-file \f[R] @@ -11,7 +11,7 @@ or .PP \f[CR]testssl.sh [BANNER OPTIONS]\f[R] .SS DESCRIPTION -testssl.sh is a free command line tool which checks a server\(cqs +testssl.sh is a free command line tool which checks a server\[cq]s service on any port for the support of TLS/SSL ciphers, protocols as well as cryptographic flaws and much more. .PP @@ -25,7 +25,7 @@ properly. Only you see the result. You also can use it internally on your LAN. Except DNS lookups or unless you instruct testssl.sh to check for -revocation of certificates it doesn\(cqt use any other hosts or even +revocation of certificates it doesn\[cq]t use any other hosts or even third parties for any test. .SS REQUIREMENTS Testssl.sh is out of the box portable: it runs under any Unix\-like @@ -56,7 +56,7 @@ SSL/TLS protocol check .IP " 2)" 4 standard cipher categories .IP " 3)" 4 -server\(cqs cipher preferences (server order?) +server\[cq]s cipher preferences (server order?) .IP " 4)" 4 forward secrecy: ciphers and elliptical curves .IP " 5)" 4 @@ -78,7 +78,7 @@ scans all IPs with the specified options or using the default run \- unless specified otherwise, see \f[CR]\-\-ip\f[R], \f[CR]\-4\f[R] and \f[CR]\-6\f[R]. IPv6 connectivity is automagically checked. -If there\(cqs noch such thing you will see a banner \f[I]Testing all +If there\[cq]s noch such thing you will see a banner \f[I]Testing all \f[BI]IPv4\f[I] addresses\f[R] and all IPv6 addresses will appear in round brackets. .SS OPTIONS AND PARAMETERS @@ -145,13 +145,13 @@ You can also supply additional options which will be inherited to each child, e.g.\ When invoking \f[CR]testssl.sh \-\-wide \-\-log \-\-file \f[R] . Each single line in \f[CR]fname\f[R] is parsed upon execution. -If there\(cqs a conflicting option and serial mass testing option is +If there\[cq]s a conflicting option and serial mass testing option is being performed the check will be aborted at the time it occurs and depending on the output option potentially leaving you with an output file without footer. -In parallel mode the mileage varies, likely a line won\(cqt be scanned. +In parallel mode the mileage varies, likely a line won\[cq]t be scanned. .PP -Alternatively \f[CR]fname\f[R] can be in \f[CR]nmap\f[R]\(cqs +Alternatively \f[CR]fname\f[R] can be in \f[CR]nmap\f[R]\[cq]s grep(p)able output format (\f[CR]\-oG\f[R]). Only open ports will be considered. Multiple ports per line are allowed. @@ -160,10 +160,10 @@ common practice in the internet, i.e.\ if nmap shows in its output an open port 25, automatically \f[CR]\-t smtp\f[R] will be added before the URI whereas port 465 will be treated as a plain TLS/SSL port, not requiring an STARTTLS SMTP handshake upfront. -This is done by an internal table which correlates nmap\(cqs open port +This is done by an internal table which correlates nmap\[cq]s open port detected to the STARTTLS/plain text decision from testssl.sh. .PP -Nmap\(cqs output always returns IP addresses and only if there\(cqs a +Nmap\[cq]s output always returns IP addresses and only if there\[cq]s a PTR DNS record available a hostname. As it is not checked by nmap whether the hostname matches the IP (A or AAAA record), testssl.sh does this automatically for you. @@ -173,7 +173,7 @@ Please keep in mind that checks against an IP address might not hit the vhost you maybe were aiming at and thus it may lead to different results. .PP -A typical internal conversion to testssl.sh file format from nmap\(cqs +A typical internal conversion to testssl.sh file format from nmap\[cq]s grep(p)able format could look like: .IP .EX @@ -187,7 +187,7 @@ grep(p)able format could look like: .EE .PP Please note that \f[CR]fname\f[R] has to be in Unix format. -DOS carriage returns won\(cqt be accepted. +DOS carriage returns won\[cq]t be accepted. Instead of the command line switch the environment variable FNAME will be honored too. .PP @@ -204,7 +204,7 @@ equal \f[CR]serial\f[R] or \f[CR]parallel\f[R]. The warnings parameter determines how testssl.sh will deal with situations where user input normally will be necessary. There are two options. -\f[CR]batch\f[R] doesn\(cqt wait for a confirming keypress when a +\f[CR]batch\f[R] doesn\[cq]t wait for a confirming keypress when a client\- or server\-side problem is encountered. As of 3.0 it just then terminates the particular scan. This is automatically chosen for mass testing (\f[CR]\-\-file\f[R]). @@ -221,24 +221,24 @@ The same can be achieved by setting the environment variable \f[CR]\-\-socket\-timeout \f[R] This is useful for socket TCP connections to a node. If the node does not complete a TCP handshake (e.g.\ because it is down -or behind a firewall or there\(cqs an IDS or a tarpit) testssl.sh may +or behind a firewall or there\[cq]s an IDS or a tarpit) testssl.sh may usually hang for around 2 minutes or even much more. This parameter instructs testssl.sh to wait at most \f[CR]seconds\f[R] for the handshake to complete before giving up. This option only works if your OS has a timeout binary installed. SOCKET_TIMEOUT is the corresponding environment variable. -This doesn\(cqt work on Macs out of the box. +This doesn\[cq]t work on Macs out of the box. .PP \f[CR]\-\-openssl\-timeout \f[R] This is especially useful for all connects using openssl and practically useful for mass testing. -It avoids the openssl connect to hang for \(ti2 minutes. +It avoids the openssl connect to hang for \[ti]2 minutes. The expected parameter \f[CR]seconds\f[R] instructs testssl.sh to wait before the openssl connect will be terminated. The option is only available if your OS has a timeout binary installed. As there are different implementations of \f[CR]timeout\f[R]: It automatically calls the binary with the right parameters. OPENSSL_TIMEOUT is the equivalent environment variable. -This doesn\(cqt work on Macs out of the box. +This doesn\[cq]t work on Macs out of the box. .PP \f[CR]\-\-basicauth \f[R] This can be set to provide HTTP basic auth credentials which are used during checks for security @@ -250,7 +250,7 @@ HTTP request headers in the correct format \f[CR]Headername: headercontent\f[R]. This parameter can be called multiple times if required. For example: -\f[CR]\-\-reqheader \(aqProxy\-Authorization: Basic dGVzdHNzbDpydWxlcw==\(aq \-\-reqheader \(aqClientID: 0xDEADBEAF\(aq\f[R]. +\f[CR]\-\-reqheader \[aq]Proxy\-Authorization: Basic dGVzdHNzbDpydWxlcw==\[aq] \-\-reqheader \[aq]ClientID: 0xDEADBEAF\[aq]\f[R]. REQHEADER is the corresponding environment variable. .PP \f[CR]\-\-mtls \f[R] This can be set to provide a @@ -268,7 +268,7 @@ against a STARTTLS enabled \f[CR]protocol\f[R]. \f[CR]mysql\f[R]. For the latter four you need e.g.\ the supplied OpenSSL or OpenSSL version 1.1.1. -Please note: MongoDB doesn\(cqt offer a STARTTLS connection, IRC +Please note: MongoDB doesn\[cq]t offer a STARTTLS connection, IRC currently only works with \f[CR]\-\-ssl\-native\f[R]. \f[CR]irc\f[R] is WIP. .PP @@ -292,7 +292,7 @@ the supplied hostname to a different IP, similar as if you would edit \f[CR]/c/Windows/System32/drivers/etc/hosts\f[R]. \f[CR]\-\-ip=proxy\f[R] tries a DNS resolution via proxy. \f[CR]\-\-ip=proxy\f[R] plus \f[CR]\-\-nodns=min\f[R] is useful for -situations with no local DNS as there\(cqll be no DNS timeouts when +situations with no local DNS as there\[cq]ll be no DNS timeouts when trying to resolve CAA, TXT and MX records. .PP \f[CR]\-\-proxy :\f[R] does ANY check via the specified @@ -310,7 +310,7 @@ In addition if you want lookups via proxy you can specify OCSP revocation checking (\f[CR]\-S \-\-phone\-out\f[R]) is not supported by OpenSSL via proxy. As supplying a proxy is an indicator for port 80 and 443 outgoing being -blocked in your network an OCSP revocation check won\(cqt be performed. +blocked in your network an OCSP revocation check won\[cq]t be performed. However if \f[CR]IGN_OCSP_PROXY=true\f[R] has been supplied it will be tried directly. Authentication to the proxy is not supported, also no HTTPS or SOCKS @@ -321,12 +321,12 @@ Besides the OpenSSL binary supplied IPv6 is known to work with vanilla OpenSSL >= 1.1.0 and older versions >=1.0.2 in RHEL/CentOS/FC and Gentoo. Scans are somewhat in line with tools like curl or wget, i.e.\ if -there\(cqs an IPv6 address of the target which can be reached, it just +there\[cq]s an IPv6 address of the target which can be reached, it just uses them. -If you don\(cqt want this behavior, you need to supply \f[CR]\-4.\f[R] +If you don\[cq]t want this behavior, you need to supply \f[CR]\-4.\f[R] .PP \f[CR]\-4\f[R] scans only IPv4 addresses of the target, IPv6 addresses -of the target won\(cqt be scanned. +of the target won\[cq]t be scanned. .PP \f[CR]\-\-ssl\-native\f[R] Instead of using a mixture of bash sockets and a few openssl s_client connects, testssl.sh uses the latter (almost) @@ -345,7 +345,7 @@ provided by your openssl binary. \f[CR]\-\-openssl \f[R] testssl.sh tries first very hard to find the binary supplied (where the tree of testssl.sh resides, from the directory where testssl.sh has been started from, etc.). -If all that doesn\(cqt work it falls back to openssl supplied from the +If all that doesn\[cq]t work it falls back to openssl supplied from the OS (\f[CR]$PATH\f[R]). With this option you can point testssl.sh to your binary of choice and override any internal magic to find the openssl binary. @@ -361,7 +361,7 @@ version. for old F5 devices. The option is passed as \f[CR]\-bug\f[R] to openssl when needed, see \f[CR]s_client(1)\f[R], environment preset via -\f[CR]BUGS=\(dq\-bugs\(dq\f[R] (1x dash). +\f[CR]BUGS=\[dq]\-bugs\[dq]\f[R] (1x dash). For the socket part testssl.sh has always workarounds in place to cope with broken server implementations. .PP @@ -384,21 +384,21 @@ to a DNS name. \f[CR]none\f[R] performs no DNS lookups at all. For the latter you either have to supply the IP address as a target, to use \f[CR]\-\-ip\f[R] or have the IP address in \f[CR]/etc/hosts\f[R]. -The use of the switch is only useful if you either can\(cqt or are not +The use of the switch is only useful if you either can\[cq]t or are not willing to perform DNS lookups. The latter can apply e.g.\ to some pentests. In general this option could e.g.\ help you to avoid timeouts by DNS lookups. \f[CR]NODNS\f[R] is the environment variable for this. \f[CR]\-\-nodns=min\f[R] plus \f[CR]\-\-ip=proxy\f[R] is useful for -situations with no local DNS as there\(cqll be no DNS timeouts when +situations with no local DNS as there\[cq]ll be no DNS timeouts when trying to resolve CAA, TXT and MX records. .PP \f[CR]\-\-sneaky\f[R] For HTTP header checks testssl.sh uses normally the server friendly HTTP user agent \f[CR]TLS tester from ${URL}\f[R]. With this option your traces are less verbose and a Firefox user agent is being used. -Be aware that it doesn\(cqt hide your activities. +Be aware that it doesn\[cq]t hide your activities. That is just not possible (environment preset via \f[CR]SNEAKY=true\f[R]). .PP @@ -418,12 +418,12 @@ and / or USLEEP_REC and maybe MAX_WAITSOCK. .PP \f[CR]\-\-phone\-out\f[R] Checking for revoked certificates via CRL and OCSP is not done per default. -This switch instructs testssl.sh to query external \(en in a sense of -the current run \(en URIs. +This switch instructs testssl.sh to query external \[en] in a sense of +the current run \[en] URIs. By using this switch you acknowledge that the check might have privacy issues, a download of several megabytes (CRL file) may happen and there may be network connectivity problems while contacting the endpoint which -testssl.sh doesn\(cqt handle. +testssl.sh doesn\[cq]t handle. PHONE_OUT is the environment variable for this which needs to be set to true if you want this. .PP @@ -457,7 +457,7 @@ Per default it lists the following parameters: \f[CR]hexcode\f[R], Please note the \f[CR]\-\-mapping\f[R] parameter changes what cipher suite names you will see here and at which position. Also please note that the \f[B]bit\f[R] length for the encryption is -shown and not the \f[B]security\f[R] length, albeit it\(cqll be sorted +shown and not the \f[B]security\f[R] length, albeit it\[cq]ll be sorted by the latter. For 3DES due to the Meet\-in\-the\-Middle problem the bit size of 168 bits is equivalent to the security size of 112 bits. @@ -474,33 +474,33 @@ though. suites / cipher categories by strength. (\f[CR]\-\-standard\f[R] is deprecated.) Those lists are (\f[CR]openssl ciphers $LIST\f[R], $LIST from below:) -.IP \(bu 2 +.IP \[bu] 2 \f[CR]NULL encryption ciphers\f[R]: `NULL:eNULL' -.IP \(bu 2 +.IP \[bu] 2 \f[CR]Anonymous NULL ciphers\f[R]: `aNULL:ADH' -.IP \(bu 2 +.IP \[bu] 2 \f[CR]Export ciphers\f[R] (w/o the preceding ones): `EXPORT:!ADH:!NULL' -.IP \(bu 2 +.IP \[bu] 2 \f[CR]LOW\f[R] (64 Bit + DES ciphers, without EXPORT ciphers): `LOW:DES:RC2:RC4:MD5:!ADH:!EXP:!NULL:!eNULL:!AECDH' -.IP \(bu 2 +.IP \[bu] 2 \f[CR]3DES + IDEA ciphers\f[R]: `3DES:IDEA:!aNULL:!ADH:!MD5' -.IP \(bu 2 +.IP \[bu] 2 \f[CR]Obsoleted CBC ciphers\f[R]: `HIGH:MEDIUM:AES:CAMELLIA:ARIA:!IDEA:!CHACHA20:!3DES:!RC2:!RC4:!AESCCM8:!AESCCM:!AESGCM:!ARIAGCM:!aNULL:!MD5' -.IP \(bu 2 +.IP \[bu] 2 \f[CR]Strong ciphers with no FS\f[R] (AEAD): `AESGCM:CHACHA20:CamelliaGCM:AESCCM:ARIAGCM:!kEECDH:!kEDH:!kDHE:!kDHEPSK:!kECDHEPSK:!aNULL' -.IP \(bu 2 +.IP \[bu] 2 \f[CR]Forward Secrecy strong ciphers\f[R] (AEAD): `AESGCM:CHACHA20:CamelliaGCM:AESCCM:ARIAGCM:!kPSK:!kRSAPSK:!kRSA:!kDH:!kECDH:!aNULL' .PP \f[CR]\-f, \-\-fs, \-\-nsa, \-\-forward\-secrecy\f[R] Checks robust forward secrecy key exchange. -\(lqRobust\(rq means that ciphers having intrinsic severe weaknesses -like Null Authentication or Encryption, 3DES and RC4 won\(cqt be +\[lq]Robust\[rq] means that ciphers having intrinsic severe weaknesses +like Null Authentication or Encryption, 3DES and RC4 won\[cq]t be considered here. -There shouldn\(cqt be the wrong impression that a secure key exchange +There shouldn\[cq]t be the wrong impression that a secure key exchange has been taking place and everything is fine when in reality the encryption sucks. Also this section lists the available elliptical curves and Diffie @@ -522,54 +522,54 @@ Also this will be tried for the QUIC check. \f[CR]\-P, \-\-server\-preference, \-\-preference\f[R] displays the servers preferences: cipher order, with used openssl client: negotiated protocol and cipher. -If there\(cqs a cipher order enforced by the server it displays it for +If there\[cq]s a cipher order enforced by the server it displays it for each protocol (openssl+sockets). -If there\(cqs not, it displays instead which ciphers from the server +If there\[cq]s not, it displays instead which ciphers from the server were picked with each protocol. .PP \f[CR]\-S, \-\-server_defaults\f[R] displays information from the server hello(s): -.IP \(bu 2 +.IP \[bu] 2 Available TLS extensions, -.IP \(bu 2 +.IP \[bu] 2 TLS ticket + session ID information/capabilities, -.IP \(bu 2 +.IP \[bu] 2 session resumption capabilities, -.IP \(bu 2 +.IP \[bu] 2 TLS 1.3 early data, a.k.a 0\-RTT -.IP \(bu 2 +.IP \[bu] 2 Time skew relative to localhost (most server implementations return random values). -.IP \(bu 2 +.IP \[bu] 2 Several certificate information .RS 2 -.IP \(bu 2 +.IP \[bu] 2 signature algorithm, -.IP \(bu 2 +.IP \[bu] 2 key size, -.IP \(bu 2 +.IP \[bu] 2 key usage and extended key usage, -.IP \(bu 2 +.IP \[bu] 2 fingerprints and serial -.IP \(bu 2 +.IP \[bu] 2 Common Name (CN), Subject Alternative Name (SAN), Issuer, -.IP \(bu 2 +.IP \[bu] 2 Trust via hostname + chain of trust against supplied certificates -.IP \(bu 2 +.IP \[bu] 2 EV certificate detection -.IP \(bu 2 -experimental \(lqeTLS\(rq detection -.IP \(bu 2 +.IP \[bu] 2 +experimental \[lq]eTLS\[rq] detection +.IP \[bu] 2 validity: start + end time, how many days to go (warning for certificate lifetime >=5 years) -.IP \(bu 2 +.IP \[bu] 2 revocation info (CRL, OCSP, OCSP stapling + must staple). When \f[CR]\-\-phone\-out\f[R] supplied it checks against the certificate issuer whether the host certificate has been revoked (plain OCSP, CRL). -.IP \(bu 2 +.IP \[bu] 2 displaying DNS Certification Authority Authorization resource record -.IP \(bu 2 +.IP \[bu] 2 Certificate Transparency info (if provided by server). .RE .PP @@ -590,7 +590,7 @@ client. Only a few TLS stacks nowadays still support this and return the local clock \f[CR]gmt_unix_time\f[R], e.g.\ IIS, openssl < 1.0.1f. In addition to the HTTP date you could e.g.\ derive that there are -different hosts where your TLS and your HTTP request ended \(en if the +different hosts where your TLS and your HTTP request ended \[en] if the time deltas differ significantly. .PP \f[CR]\-x , \-\-single\-cipher \f[R] tests matched @@ -601,29 +601,29 @@ above about matching. \f[CR]\-h, \-\-header, \-\-headers\f[R] if the service is HTTP (either by detection or by enforcing via \f[CR]\-\-assume\-http\f[R]. It tests several HTTP headers like -.IP \(bu 2 +.IP \[bu] 2 HTTP Strict Transport Security (HSTS) -.IP \(bu 2 +.IP \[bu] 2 HTTP Public Key Pinning (HPKP) -.IP \(bu 2 +.IP \[bu] 2 Server banner -.IP \(bu 2 +.IP \[bu] 2 HTTP date+time -.IP \(bu 2 +.IP \[bu] 2 Server banner like Linux or other Unix vendor headers -.IP \(bu 2 +.IP \[bu] 2 Application banner (PHP, RoR, OWA, SharePoint, Wordpress, etc) -.IP \(bu 2 +.IP \[bu] 2 Reverse proxy headers -.IP \(bu 2 +.IP \[bu] 2 Web server modules -.IP \(bu 2 +.IP \[bu] 2 IPv4 address in header -.IP \(bu 2 +.IP \[bu] 2 Cookie (including Secure/HTTPOnly flags) -.IP \(bu 2 +.IP \[bu] 2 Decodes BIG IP F5 non\-encrypted cookies -.IP \(bu 2 +.IP \[bu] 2 Security headers (X\-Frame\-Options, X\-XSS\-Protection, Expect\-CT,\&... , CSP headers). @@ -633,7 +633,7 @@ Nonsense is not yet detected here. number of standard clients so that you can figure out which client cannot or can connect to your site. For the latter case the protocol, cipher and curve is displayed, also if -there\(cqs Forward Secrecy. +there\[cq]s Forward Secrecy. testssl.sh uses a handselected set of clients which are retrieved by the SSLlabs API. The output is aligned in columns when combined with the @@ -643,24 +643,14 @@ variable ALL_CLIENTS. .PP \f[CR]\-g, \-\-grease\f[R] checks several server implementation bugs like tolerance to size limitations and GREASE, see RFC 8701. -This check doesn\(cqt run per default. +This check doesn\[cq]t run per default. .SS VULNERABILITIES \f[CR]\-U, \-\-vulnerable, \-\-vulnerabilities\f[R] Just tests all (of the following) vulnerabilities. -The environment variable \f[CR]VULN_THRESHLD\f[R] determines after which -value a separate headline for each vulnerability is being displayed. -Default is \f[CR]1\f[R] which means if you check for two -vulnerabilities, only the general headline for vulnerabilities section -is displayed \(en in addition to the vulnerability and the result. -Otherwise each vulnerability or vulnerability section gets its own -headline in addition to the output of the name of the vulnerability and -test result. -A vulnerability section is comprised of more than one check, e.g.\ the -renegotiation vulnerability check has two checks, so has Logjam. .PP \f[CR]\-H, \-\-heartbleed\f[R] Checks for Heartbleed, a memory leakage in openssl. -Unless the server side doesn\(cqt support the heartbeat extension it is +Unless the server side doesn\[cq]t support the heartbeat extension it is likely that this check runs into a timeout. The seconds to wait for a reply can be adjusted with \f[CR]HEARTBLEED_MAX_WAITSOCK\f[R]. @@ -679,14 +669,16 @@ BigIP loadbalancers. vulnerability named Opossum. .PP \f[CR]\-\-BB, \-\-robot\f[R] Checks for vulnerability to ROBOT / -(\f[I]Return Of Bleichenbacher\(cqs Oracle Threat\f[R]) attack. +(\f[I]Return Of Bleichenbacher\[cq]s Oracle Threat\f[R]) attack. +The predefined timeout of 5 seconds can be changed with the environment +variable \f[CR]ROBOT_TIMEOUT\f[R]. .PP \f[CR]\-\-SI, \-\-starttls\-injection\f[R] Checks for STARTTLS injection vulnerabilities (SMTP, IMAP, POP3 only). \f[CR]socat\f[R] and OpenSSL >=1.1.0 is needed. .PP \f[CR]\-R, \-\-renegotiation\f[R] Tests renegotiation vulnerabilities. -Currently there\(cqs a check for \f[I]Secure Renegotiation\f[R] and for +Currently there\[cq]s a check for \f[I]Secure Renegotiation\f[R] and for \f[I]Secure Client\-Initiated Renegotiation\f[R]. Please be aware that vulnerable servers to the latter can likely be DoSed very easily (HTTP). @@ -701,9 +693,9 @@ CRIME in SPDY is not yet being checked for. Reconnaissance and Exfiltration via Adaptive Compression of Hypertext\f[R]) vulnerability. As for this vulnerability HTTP level compression is a prerequisite -it\(cqll be not tested if HTTP cannot be detected or the detection is +it\[cq]ll be not tested if HTTP cannot be detected or the detection is not enforced via \f[CR]\-\-assume\-http\f[R]. -Please note that only the URL supplied (normally \(lq/\(rq ) is being +Please note that only the URL supplied (normally \[lq]/\[rq] ) is being tested. .PP \f[CR]\-O, \-\-poodle\f[R] Tests for SSL POODLE (\f[I]Padding Oracle On @@ -726,12 +718,12 @@ RSA Export Keys\f[R]) by testing for EXPORT RSA ciphers checking whether the SSL 2 protocol is available at the target. Please note that if you use the same RSA certificate elsewhere you might be vulnerable too. -testssl.sh doesn\(cqt check for this but provides a helpful link \(at +testssl.sh doesn\[cq]t check for this but provides a helpful link \[at] censys.io which provides this service. .PP \f[CR]\-J, \-\-logjam\f[R] Checks for LOGJAM vulnerability by checking for DH EXPORT ciphers. -It also checks for \(lqcommon primes\(rq which are preconfigured DH +It also checks for \[lq]common primes\[rq] which are preconfigured DH keys. DH keys =< 1024 Bit will be penalized. Also FFDHE groups (TLS 1.2) will be displayed here. @@ -756,7 +748,7 @@ This option suppresses it. Please note that by choosing this option you acknowledge usage terms and the warning normally appearing in the banner. .PP -\f[CR]\-\-wide\f[R] Except the \(lqeach cipher output\(rq all tests +\f[CR]\-\-wide\f[R] Except the \[lq]each cipher output\[rq] all tests displays the single cipher name (scheme see below). This option enables testssl.sh to display also for the following sections the same output as for testing each ciphers: BEAST, FS, RC4. @@ -766,25 +758,25 @@ proper headline. The environment variable \f[CR]WIDE\f[R] can be used instead. .PP \f[CR]\-\-mapping \f[R] -.IP \(bu 2 +.IP \[bu] 2 \f[CR]openssl\f[R]: use the OpenSSL cipher suite name as the primary name cipher suite name form (default), -.IP \(bu 2 +.IP \[bu] 2 \f[CR]iana\f[R]: use the IANA cipher suite name as the primary name cipher suite name form. -.IP \(bu 2 -\f[CR]no\-openssl\f[R]: don\(cqt display the OpenSSL cipher suite name, +.IP \[bu] 2 +\f[CR]no\-openssl\f[R]: don\[cq]t display the OpenSSL cipher suite name, display IANA names only. -.IP \(bu 2 -\f[CR]no\-iana\f[R]: don\(cqt display the IANA cipher suite name, +.IP \[bu] 2 +\f[CR]no\-iana\f[R]: don\[cq]t display the IANA cipher suite name, display OpenSSL names only. .PP Please note that in testssl.sh 3.0 you can still use \f[CR]rfc\f[R] instead of \f[CR]iana\f[R] and \f[CR]no\-rfc\f[R] instead of -\f[CR]no\-iana\f[R] but it\(cqll disappear after 3.0. +\f[CR]no\-iana\f[R] but it\[cq]ll disappear after 3.0. .PP \f[CR]\-\-show\-each\f[R] This is an option for all wide modes only: it -displays all ciphers tested \(en not only succeeded ones. +displays all ciphers tested \[en] not only succeeded ones. \f[CR]SHOW_EACH_C\f[R] is your friend if you prefer to set this via the shell environment. .PP @@ -820,7 +812,7 @@ screen output normal but leaves useful debug output in The info about the exact directory is included in the screen output in the end of the run. .IP "2." 3 -lists more what\(cqs going on, status (high level) and connection +lists more what\[cq]s going on, status (high level) and connection errors, a few general debug output .IP "3." 3 even slightly more info: hexdumps + other info @@ -842,8 +834,8 @@ directory of the shell. Depending on the color output option (see above) the output file will contain color and other markup escape codes, unless you specify \f[CR]\-\-color 0\f[R] too. -\f[CR]cat\f[R] and \(en if properly configured \f[CR]less\f[R] \(en will -show the output properly formatted on your terminal. +\f[CR]cat\f[R] and \[en] if properly configured \f[CR]less\f[R] \[en] +will show the output properly formatted on your terminal. The output shows a banner with the almost the same information as on the screen. In addition it shows the command line of the testssl.sh instance. @@ -868,11 +860,11 @@ You can override the width with the environment variable TERM_WIDTH. \f[CR]${NODE}\-p${port}${YYYYMMDD\-HHMM}.json\f[R] in the current working directory of the shell. The resulting JSON file is opposed to \f[CR]\-\-json\-pretty\f[R] flat -\(en which means each section is self contained and has an identifier +\[en] which means each section is self contained and has an identifier for each single check, the hostname/IP address, the port, severity and the finding. For vulnerabilities it may contain a CVE and CWE entry too. -The output doesn\(cqt contain a banner or a footer. +The output doesn\[cq]t contain a banner or a footer. .PP \f[CR]\-\-jsonfile \f[R] or \f[CR]\-oj \f[R] Instead of the previous option you may want to use this one if you want to log @@ -886,8 +878,8 @@ path is also permitted here. \f[CR]\-\-json\-pretty\f[R] Logs additionally to JSON file \f[CR]${NODE}\-p${port}${YYYYMMDD\-HHMM}.json\f[R] in the current working directory of the shell. -The resulting JSON file is opposed to \f[CR]\-\-json\f[R] non\-flat \(en -which means it is structured. +The resulting JSON file is opposed to \f[CR]\-\-json\f[R] non\-flat +\[en] which means it is structured. The structure contains a header similar to the banner on the screen, including the command line, scan host, openssl binary used, testssl version and epoch of the start time. @@ -924,7 +916,7 @@ For further explanation see \f[CR]\-\-jsonfile\f[R] or \f[CR]${NODE}\-p${port}${YYYYMMDD\-HHMM}.html\f[R] in the current working directory of the shell. It contains a 1:1 output of the console. -In former versions there was a non\-native option to use \(lqaha\(rq +In former versions there was a non\-native option to use \[lq]aha\[rq] (Ansi HTML Adapter: github.com/theZiz/aha) like \f[CR]testssl.sh [options] | aha >output.html\f[R]. This is not necessary anymore. @@ -969,7 +961,7 @@ remove the file and exit with an error. header. The environment variable APPEND does the same. Be careful using this switch/variable. -A complementary option which overwrites an existing file doesn\(cqt +A complementary option which overwrites an existing file doesn\[cq]t exist per design. .PP \f[CR]\-\-overwrite\f[R] Normally, if an output file already exists and @@ -986,7 +978,7 @@ Using this any output files will be named \f[CR]\-${NODE}\-p${port}${YYYYMMDD\-HHMM}.\f[R] when no file name of the respective output option was specified. If you do not like the separator `\-' you can as well supply a -\f[CR]\f[R] ending in `.', \(cq_\(cq or `,'. +\f[CR]\f[R] ending in `.', \[cq]_\[cq] or `,'. In this case or if you already supplied `\-' no additional `\-' will be appended to \f[CR]\f[R]. .PP @@ -994,49 +986,49 @@ A few file output options can also be preset via environment variables. .SS COLOR RATINGS Testssl.sh makes use of (the eight) standard terminal colors. The color scheme is as follows: -.IP \(bu 2 +.IP \[bu] 2 light red: a critical finding -.IP \(bu 2 +.IP \[bu] 2 red: a high finding -.IP \(bu 2 +.IP \[bu] 2 brown: a medium finding -.IP \(bu 2 +.IP \[bu] 2 yellow: a low finding -.IP \(bu 2 +.IP \[bu] 2 green (blue if COLORBLIND is set): something which is either in general a good thing or a negative result of a check which otherwise results in a high finding -.IP \(bu 2 +.IP \[bu] 2 light green (light blue if COLORBLIND is set) : something which is either in general a very good thing or a negative result of a check which otherwise results in a critical finding -.IP \(bu 2 +.IP \[bu] 2 no color at places where also a finding can be expected: a finding on an info level -.IP \(bu 2 +.IP \[bu] 2 cyan: currently only used for \f[CR]\-\-show\-each\f[R] or an additional hint -.IP \(bu 2 +.IP \[bu] 2 magenta: signals a warning condition, e.g.\ either a local lack of capabilities on the client side or another problem -.IP \(bu 2 +.IP \[bu] 2 light magenta: a fatal error which either requires strict consent from the user to continue or a condition which leaves no other choice for testssl.sh to quit .PP -What is labeled as \(lqlight\(rq above appears as such on the screen but -is technically speaking \(lqbold\(rq. +What is labeled as \[lq]light\[rq] above appears as such on the screen +but is technically speaking \[lq]bold\[rq]. Besides \f[CR]\-\-color=3\f[R] will color ciphers according to an internal and rough rating. .PP Markup (without any color) is used in the following manner: -.IP \(bu 2 +.IP \[bu] 2 bold: for the name of the test -.IP \(bu 2 +.IP \[bu] 2 underline + bold: for the headline of each test section -.IP \(bu 2 +.IP \[bu] 2 underline: for a sub\-headline -.IP \(bu 2 +.IP \[bu] 2 italics: for strings just reflecting a value read from the server .SS TUNING via ENV variables and more options Except the environment variables mentioned above which can replace @@ -1044,147 +1036,138 @@ command line options here a some which cannot be set otherwise. Variables used for tuning are preset with reasonable values. \f[I]There should be no reason to change them\f[R] unless you use testssl.sh under special conditions. -.IP \(bu 2 +.IP \[bu] 2 TERM_WIDTH is a variable which overrides the auto\-determined terminal width size. Setting this variable normally only makes sense if you log the output to a file using the \f[CR]\-\-log\f[R], \f[CR]\-\-logfile\f[R] or \f[CR]\-oL\f[R] option. -.IP \(bu 2 +.IP \[bu] 2 DEBUG_ALLINONE / SETX: when setting one of those to true testssl.sh falls back to the standard bash behavior, i.e.\ calling \f[CR]bash \-x testssl.sh\f[R] it displays the bash debugging output not in an external file \f[CR]/tmp/testssl\-.log\f[R] -.IP \(bu 2 +.IP \[bu] 2 DEBUGTIME: Profiling option. -When using bash\(cqs debug mode and when this is set to true, it +When using bash\[cq]s debug mode and when this is set to true, it generates a separate text file with epoch times in \f[CR]/tmp/testssl\-.time\f[R]. They need to be concatenated by -\f[CR]paste /tmp/testssl\-.{time,log}\f[R] -.IP \(bu 2 +\f[CR]paste /tmp/testssl\-.{time,log}\f[R] +.IP \[bu] 2 EXPERIMENTAL=true is an option which is sometimes used in the development process to make testing easier. In released versions this has no effect. -.IP \(bu 2 +.IP \[bu] 2 ALL_CLIENTS=true runs a client simulation with \f[I]all\f[R] (currently 126) clients when testing HTTP. -.IP \(bu 2 +.IP \[bu] 2 UNBRACKTD_IPV6: needs to be set to true for some old versions of OpenSSL -(like from Gentoo) which don\(cqt support [bracketed] IPv6 addresses -.IP \(bu 2 +(like from Gentoo) which don\[cq]t support [bracketed] IPv6 addresses +.IP \[bu] 2 NO_ENGINE: if you have problems with garbled output containing the word `engine' you might want to set this to true. -It forces testssl.sh not try to configure openssl\(cqs engine or a non +It forces testssl.sh not try to configure openssl\[cq]s engine or a non existing one from libressl -.IP \(bu 2 +.IP \[bu] 2 HEADER_MAXSLEEP: To wait how long before killing the process to retrieve a service banner / HTTP header -.IP \(bu 2 +.IP \[bu] 2 MAX_WAITSOCK: It instructs testssl.sh to wait until the specified time before declaring a socket connection dead. -Don\(cqt change this unless you\(cqre absolutely sure what you\(cqre +Don\[cq]t change this unless you\[cq]re absolutely sure what you\[cq]re doing. Value is in seconds. -.IP \(bu 2 +.IP \[bu] 2 CCS_MAX_WAITSOCK Is the similar to above but applies only to the CCS handshakes, for both of the two the two CCS payload. -Don\(cqt change this unless you\(cqre absolutely sure what you\(cqre +Don\[cq]t change this unless you\[cq]re absolutely sure what you\[cq]re doing. Value is in seconds. -.IP \(bu 2 +.IP \[bu] 2 HEARTBLEED_MAX_WAITSOCK Is the similar to MAX_WAITSOCK but applies only to the ServerHello after sending the Heartbleed payload. -Don\(cqt change this unless you\(cqre absolutely sure what you\(cqre +Don\[cq]t change this unless you\[cq]re absolutely sure what you\[cq]re doing. Value is in seconds. -.IP \(bu 2 -MEASURE_TIME_FILE For seldom cases when you don\(cqt want the scan time +.IP \[bu] 2 +ROBOT_TIMEOUT is similar to above and applies to the ROBOT check. +.IP \[bu] 2 +MEASURE_TIME_FILE For seldom cases when you don\[cq]t want the scan time to be included in the output you can set this to false. -.IP \(bu 2 +.IP \[bu] 2 STARTTLS_SLEEP is per default set to 10 (seconds). -That\(cqs the value testssl.sh waits for a string in the STARTTLS +That\[cq]s the value testssl.sh waits for a string in the STARTTLS handshake before giving up. -.IP \(bu 2 +.IP \[bu] 2 MAX_PARALLEL is the maximum number of tests to run in parallel in parallel mass testing mode. The default value of 20 may be made larger on systems with faster processors. -.IP \(bu 2 +.IP \[bu] 2 MAX_WAIT_TEST is the maximum time (in seconds) to wait for a single test in parallel mass testing mode to complete. The default is 1200. - -.IP \(bu 2 +.IP \[bu] 2 HSTS_MIN is preset to 179 (days). If you want warnings sooner or later for HTTP Strict Transport Security you can change this. -.IP \(bu 2 +.IP \[bu] 2 HPKP_MIN is preset to 30 (days). If you want warnings sooner or later for HTTP Public Key Pinning you can change this -.IP \(bu 2 -DAYS2WARN1 is the first threshold when you\(cqll be warning of a +.IP \[bu] 2 +DAYS2WARN1 is the first threshold when you\[cq]ll be warning of a certificate expiration of a host, preset to 60 (days). -For Let\(cqs Encrypt this value will be divided internally by 2. -.IP \(bu 2 -DAYS2WARN2 is the second threshold when you\(cqll be warning of a +For Let\[cq]s Encrypt this value will be divided internally by 2. +.IP \[bu] 2 +DAYS2WARN2 is the second threshold when you\[cq]ll be warning of a certificate expiration of a host, preset to 30 (days). -For Let\(cqs Encrypt this value will be divided internally by 2. -.IP \(bu 2 +For Let\[cq]s Encrypt this value will be divided internally by 2. +.IP \[bu] 2 TESTSSL_INSTALL_DIR is the derived installation directory of testssl.sh. Relatively to that the \f[CR]bin\f[R] and mandatory \f[CR]etc\f[R] directory will be looked for. -.IP \(bu 2 +.IP \[bu] 2 CA_BUNDLES_PATH: If you have an own set of CA bundles or you want to point testssl.sh to a specific location of a CA bundle, you can use this variable to set the directory which testssl.sh will use. Please note that it overrides completely the builtin path of testssl.sh which means that you will only test against the bundles you point to. -Also you might want to use \f[CR]\(ti/utils/create_ca_hashes.sh\f[R] to +Also you might want to use \f[CR]\[ti]/utils/create_ca_hashes.sh\f[R] to create the hashes for HPKP. -.IP \(bu 2 +.IP \[bu] 2 MAX_SOCKET_FAIL: A number which tells testssl.sh how often a TCP socket connection may fail before the program gives up and terminates. The default is 2. You can increase it to a higher value if you frequently see a message like \f[I]Fatal error: repeated openssl s_client connect problem, -doesn\(cqt make sense to continue\f[R]. -.IP \(bu 2 +doesn\[cq]t make sense to continue\f[R]. +.IP \[bu] 2 MAX_OSSL_FAIL: A number which tells testssl.sh how often an OpenSSL s_client connect may fail before the program gives up and terminates. The default is 2. You can increase it to a higher value if you frequently see a message like \f[I]Fatal error: repeated TCP connect problems, giving up\f[R]. -.IP \(bu 2 +.IP \[bu] 2 MAX_HEADER_FAIL: A number which tells testssl.sh how often a HTTP GET request over OpenSSL may return an empty file before the program gives up and terminates. The default is 3. Also here you can increase the threshold when you spot messages like -\f[I]Fatal error: repeated HTTP header connect problems, doesn\(cqt make -sense to continue\f[R]. -.IP \(bu 2 +\f[I]Fatal error: repeated HTTP header connect problems, doesn\[cq]t +make sense to continue\f[R]. +.IP \[bu] 2 OPENSSL2 can be used to supply an alternative openssl version. This only makes sense if you want to amend the supplied version in \f[CR]bin/\f[R] which lacks TLS 1.3 support with a version which doesn not and is not in \f[CR]/usr/bin/openssl\f[R]. -.IP \(bu 2 +.IP \[bu] 2 OSSL_SHORTCUT should be set to false when you run interactively and -don\(cqt want to switch automatically to \f[CR]/usr/bin/openssl\f[R] +don\[cq]t want to switch automatically to \f[CR]/usr/bin/openssl\f[R] (\f[CR]OPENSSL2\f[R]) if you encounter a TLS 1.3\-only host. .SS RATING -This program has a near\-complete implementation of SSL Labs\(cqs `\c +This program has a near\-complete implementation of SSL Labs\[cq]s `\c .UR https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide SSL Server Rating Guide .UE \c @@ -1192,7 +1175,7 @@ SSL Server Rating Guide .PP This is \f[I]not\f[R] a 100% reimplementation of the \c .UR https://www.ssllabs.com/ssltest/analyze.html -SSL Lab\(cqs SSL Server Test +SSL Lab\[cq]s SSL Server Test .UE \c , but an implementation of the above rating specification, slight discrepancies may occur. @@ -1203,7 +1186,7 @@ Before filing issues please inspect their Rating Guide. .PP Disclaimer: Having a good grade is \f[B]NOT\f[R] necessarily equal to having good security! -Don\(cqt start a competition for the best grade, at least not without +Don\[cq]t start a competition for the best grade, at least not without monitoring the client handshakes and not without adding a portion of good sense to it. Please note STARTTLS always results in a grade cap to T. Anything else @@ -1215,33 +1198,33 @@ Also with DANE or MTA\-STS no one can test on the server side whether a client makes use if it. .PP As of writing, these checks are missing: -.IP \(bu 2 +.IP \[bu] 2 GOLDENDOODLE \- should be graded \f[B]F\f[R] if vulnerable -.IP \(bu 2 +.IP \[bu] 2 Insecure renegotiation \- should be graded \f[B]F\f[R] if vulnerable -.IP \(bu 2 +.IP \[bu] 2 Padding oracle in AES\-NI CBC MAC check (CVE\-2016\-2107) \- should be graded \f[B]F\f[R] if vulnerable -.IP \(bu 2 +.IP \[bu] 2 Sleeping POODLE \- should be graded \f[B]F\f[R] if vulnerable -.IP \(bu 2 +.IP \[bu] 2 Zero Length Padding Oracle (CVE\-2019\-1559) \- should be graded \f[B]F\f[R] if vulnerable -.IP \(bu 2 +.IP \[bu] 2 Zombie POODLE \- should be graded \f[B]F\f[R] if vulnerable -.IP \(bu 2 +.IP \[bu] 2 All remaining old Symantec PKI certificates are distrusted \- should be graded \f[B]T\f[R] -.IP \(bu 2 +.IP \[bu] 2 Symantec certificates issued before June 2016 are distrusted \- should be graded \f[B]T\f[R] -.IP \(bu 2 +.IP \[bu] 2 Anonymous key exchange \- should give \f[B]0\f[R] points in \f[CR]set_key_str_score()\f[R] -.IP \(bu 2 +.IP \[bu] 2 Exportable key exchange \- should give \f[B]40\f[R] points in \f[CR]set_key_str_score()\f[R] -.IP \(bu 2 +.IP \[bu] 2 Weak key (Debian OpenSSL Flaw) \- should give \f[B]0\f[R] points in \f[CR]set_key_str_score()\f[R] .SS Implementing new grades caps or \-warnings @@ -1249,14 +1232,14 @@ To implement a new grading cap, simply call the \f[CR]set_grade_cap()\f[R] function, with the grade and a reason: .IP .EX -set_grade_cap \(dqD\(dq \(dqVulnerable to documentation\(dq +set_grade_cap \[dq]D\[dq] \[dq]Vulnerable to documentation\[dq] .EE .PP To implement a new grade warning, simply call the \f[CR]set_grade_warning()\f[R] function, with a message: .IP .EX -set_grade_warning \(dqDocumentation is always right\(dq +set_grade_warning \[dq]Documentation is always right\[dq] .EE .SS Implementing a new check which contains grade caps When implementing a new check (be it vulnerability or not) that sets @@ -1272,7 +1255,7 @@ This is to prevent giving out a misleading or wrong grade. .SS Implementing a new revision When a new revision of the rating specification comes around, the following has to be done: -.IP \(bu 2 +.IP \[bu] 2 New grade caps has to be either: .RS 2 .IP "1." 3 @@ -1280,9 +1263,9 @@ Added to the script wherever relevant, or .IP "2." 3 Added to the above list of missing checks (if above is not possible) .RE -.IP \(bu 2 +.IP \[bu] 2 New grade warnings has to be added wherever relevant -.IP \(bu 2 +.IP \[bu] 2 The revision output in \f[CR]run_rating()\f[R] function has to updated .SS EXAMPLES .IP @@ -1291,8 +1274,8 @@ The revision output in \f[CR]run_rating()\f[R] function has to updated .EE .PP does a default run on https://testssl.sh (protocols, standard cipher -lists, server\(cqs cipher preferences, forward secrecy, server defaults, -vulnerabilities, client simulation, and rating. +lists, server\[cq]s cipher preferences, forward secrecy, server +defaults, vulnerabilities, client simulation, and rating. .IP .EX testssl.sh testssl.net:443 @@ -1314,7 +1297,7 @@ Displayed is everything where possible in wide format. testssl.sh \-6 https://testssl.net .EE .PP -As opposed to the first example it also tests the IPv6 part \(en +As opposed to the first example it also tests the IPv6 part \[en] supposed you have an IPv6 network and your openssl supports IPv6 (see above). .IP @@ -1339,135 +1322,135 @@ port. Also MongoDB which provides TLS support without STARTTLS can be tested directly. .SS RFCs and other standards -.IP \(bu 2 +.IP \[bu] 2 RFC 2246: The TLS Protocol Version 1.0 -.IP \(bu 2 +.IP \[bu] 2 RFC 2595: Using TLS with IMAP, POP3 and ACAP -.IP \(bu 2 +.IP \[bu] 2 RFC 2817: Upgrading to TLS Within HTTP/1.1 -.IP \(bu 2 +.IP \[bu] 2 RFC 2818: HTTP Over TLS -.IP \(bu 2 +.IP \[bu] 2 RFC 2830: Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security -.IP \(bu 2 +.IP \[bu] 2 RFC 3207: SMTP Service Extension for Secure SMTP over Transport Layer Security -.IP \(bu 2 +.IP \[bu] 2 RFC 3501: INTERNET MESSAGE ACCESS PROTOCOL \- VERSION 4rev1 -.IP \(bu 2 +.IP \[bu] 2 RFC 4346: The Transport Layer Security (TLS) Protocol Version 1.1 -.IP \(bu 2 +.IP \[bu] 2 RFC 4366: Transport Layer Security (TLS) Extensions -.IP \(bu 2 +.IP \[bu] 2 RFC 4492: Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) -.IP \(bu 2 +.IP \[bu] 2 RFC 5077: Transport Layer Security (TLS) Session Resumption -.IP \(bu 2 +.IP \[bu] 2 RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2 -.IP \(bu 2 +.IP \[bu] 2 RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile -.IP \(bu 2 +.IP \[bu] 2 RFC 5321: Simple Mail Transfer Protocol -.IP \(bu 2 +.IP \[bu] 2 RFC 5746: Transport Layer Security (TLS) Renegotiation Indication Extension -.IP \(bu 2 +.IP \[bu] 2 RFC 5804: A Protocol for Remotely Managing Sieve Scripts -.IP \(bu 2 +.IP \[bu] 2 RFC 6066: Transport Layer Security (TLS) Extensions: Extension Definitions -.IP \(bu 2 +.IP \[bu] 2 RFC 6101: The Secure Sockets Layer (SSL) Protocol Version 3.0 -.IP \(bu 2 +.IP \[bu] 2 RFC 6120: Extensible Messaging and Presence Protocol (XMPP): Core -.IP \(bu 2 +.IP \[bu] 2 RFC 6125: Domain\-Based Application Service Identity [..] -.IP \(bu 2 +.IP \[bu] 2 RFC 6797: HTTP Strict Transport Security (HSTS) -.IP \(bu 2 +.IP \[bu] 2 RFC 6961: The Transport Layer Security (TLS) Multiple Certificate Status Request Extension -.IP \(bu 2 +.IP \[bu] 2 RFC 7469: Public Key Pinning Extension for HTTP (HPKP) -.IP \(bu 2 +.IP \[bu] 2 RFC 7507: TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks -.IP \(bu 2 +.IP \[bu] 2 RFC 7627: Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension -.IP \(bu 2 +.IP \[bu] 2 RFC 7633: X.509v3 Transport Layer Security (TLS) Feature Extension -.IP \(bu 2 +.IP \[bu] 2 RFC 7465: Prohibiting RC4 Cipher Suites -.IP \(bu 2 +.IP \[bu] 2 RFC 7685: A Transport Layer Security (TLS) ClientHello Padding Extension -.IP \(bu 2 +.IP \[bu] 2 RFC 7905: ChaCha20\-Poly1305 Cipher Suites for Transport Layer Security (TLS) -.IP \(bu 2 +.IP \[bu] 2 RFC 7919: Negotiated Finite Field Diffie\-Hellman Ephemeral Parameters for Transport Layer Security -.IP \(bu 2 +.IP \[bu] 2 RFC 8143: Using Transport Layer Security (TLS) with Network News Transfer Protocol (NNTP) -.IP \(bu 2 +.IP \[bu] 2 RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3 -.IP \(bu 2 +.IP \[bu] 2 RFC 8470: Using Early Data in HTTP -.IP \(bu 2 +.IP \[bu] 2 RFC 8701: Applying Generate Random Extensions And Sustain Extensibility (GREASE) to TLS Extensibility -.IP \(bu 2 +.IP \[bu] 2 RFC 9000: QUIC: A UDP\-Based Multiplexed and Secure Transport -.IP \(bu 2 +.IP \[bu] 2 W3C CSP: Content Security Policy Level 1\-3 -.IP \(bu 2 +.IP \[bu] 2 TLSWG Draft: The Transport Layer Security (TLS) Protocol Version 1.3 -.IP \(bu 2 +.IP \[bu] 2 FIPS 203: Module\-Lattice\-Based Key\-Encapsulation Mechanism Standard .PP More RFCs might be applicable. .SS EXIT STATUS -.IP \(bu 2 +.IP \[bu] 2 0 testssl.sh finished successfully without errors and without ambiguous results -.IP \(bu 2 +.IP \[bu] 2 1 testssl.sh has encountered exactly one ambiguous situation or an error during run -.IP \(bu 2 +.IP \[bu] 2 1+n same as previous. The errors or ambiguous results are added, also per IP. -.IP \(bu 2 +.IP \[bu] 2 50\-200 reserved for returning a vulnerability scoring for system monitoring or a CI tools -.IP \(bu 2 +.IP \[bu] 2 242 (ERR_CHILD) Child received a signal from master -.IP \(bu 2 -244 (ERR_RESOURCE) Resources testssl.sh needs couldn\(cqt be read -.IP \(bu 2 +.IP \[bu] 2 +244 (ERR_RESOURCE) Resources testssl.sh needs couldn\[cq]t be read +.IP \[bu] 2 245 (ERR_CLUELESS) Weird state, either though user options or testssl.sh -.IP \(bu 2 +.IP \[bu] 2 246 (ERR_CONNECT) Connectivity problem -.IP \(bu 2 +.IP \[bu] 2 247 (ERR_DNSLOOKUP) Problem with resolving IP addresses or names -.IP \(bu 2 +.IP \[bu] 2 248 (ERR_OTHERCLIENT) Other client problem -.IP \(bu 2 +.IP \[bu] 2 249 (ERR_DNSBIN) Problem with DNS lookup binaries -.IP \(bu 2 +.IP \[bu] 2 250 (ERR_OSSLBIN) Problem with OpenSSL binary -.IP \(bu 2 +.IP \[bu] 2 251 (ERR_NOSUPPORT) Feature requested is not supported -.IP \(bu 2 -252 (ERR_FNAMEPARSE) Input file couldn\(cqt be parsed -.IP \(bu 2 -253 (ERR_FCREATE) Output file couldn\(cqt be created -.IP \(bu 2 -254 (ERR_CMDLINE) Cmd line couldn\(cqt be parsed -.IP \(bu 2 +.IP \[bu] 2 +252 (ERR_FNAMEPARSE) Input file couldn\[cq]t be parsed +.IP \[bu] 2 +253 (ERR_FCREATE) Output file couldn\[cq]t be created +.IP \[bu] 2 +254 (ERR_CMDLINE) Cmd line couldn\[cq]t be parsed +.IP \[bu] 2 255 (ERR_BASH) Bash version incorrect .SS FILES \f[B]etc/*pem\f[R] are the certificate stores from Apple, Linux, Mozilla @@ -1491,9 +1474,9 @@ the terms of the license, see LICENSE. .PP Attribution is important for the future of this project \- also in the internet. -Thus if you\(cqre offering a scanner based on testssl.sh as a public +Thus if you\[cq]re offering a scanner based on testssl.sh as a public and/or paid service in the internet you are strongly encouraged to -mention to your audience that you\(cqre using this program and where to +mention to your audience that you\[cq]re using this program and where to get this program from. That helps us to get bugfixes, other feedback and more contributions. .PP diff --git a/doc/testssl.1.html b/doc/testssl.1.html index 8f1fa60..4ff813a 100644 --- a/doc/testssl.1.html +++ b/doc/testssl.1.html @@ -578,17 +578,7 @@ GREASE, see RFC 8701. This check doesn’t run per default.

VULNERABILITIES

-U, --vulnerable, --vulnerabilities Just tests - all (of the following) vulnerabilities. The environment variable - VULN_THRESHLD determines after which value a - separate headline for each vulnerability is being displayed. - Default is 1 which means if you check for two - vulnerabilities, only the general headline for vulnerabilities - section is displayed – in addition to the vulnerability and the - result. Otherwise each vulnerability or vulnerability section - gets its own headline in addition to the output of the name of - the vulnerability and test result. A vulnerability section is - comprised of more than one check, e.g. the renegotiation - vulnerability check has two checks, so has Logjam.

+ all (of the following) vulnerabilities.

-H, --heartbleed Checks for Heartbleed, a memory leakage in openssl. Unless the server side doesn’t support the heartbeat extension it is likely that this check runs into a @@ -604,8 +594,9 @@

--OP, --opossum Checks for HTTP to HTTPS upgrade vulnerability named Opossum.

--BB, --robot Checks for vulnerability to ROBOT - / (Return Of Bleichenbacher’s Oracle Threat) - attack.

+ / (Return Of Bleichenbacher’s Oracle Threat) attack. + The predefined timeout of 5 seconds can be changed with the + environment variable ROBOT_TIMEOUT.

--SI, --starttls-injection Checks for STARTTLS injection vulnerabilities (SMTP, IMAP, POP3 only). socat and OpenSSL >=1.1.0 is needed.

@@ -930,11 +921,11 @@ and when this is set to true, it generates a separate text file with epoch times in /tmp/testssl-<XX>.time. They need to be concatenated by - paste /tmp/testssl-<XX>.{time,log} - <!— -
  • FAST_SOCKET
    • -
  • SHOW_SIGALGO
    • -
  • FAST –>
    • + paste /tmp/testssl-<XX>.{time,log}
  • EXPERIMENTAL=true is an option which is sometimes used in the development process to make testing easier. In released versions this has no effect.
    • @@ -961,6 +952,8 @@ applies only to the ServerHello after sending the Heartbleed payload. Don’t change this unless you’re absolutely sure what you’re doing. Value is in seconds. +
  • ROBOT_TIMEOUT is similar to above and applies to the ROBOT + check.
  • MEASURE_TIME_FILE For seldom cases when you don’t want the scan time to be included in the output you can set this to false.
    • @@ -972,9 +965,10 @@ may be made larger on systems with faster processors.
  • MAX_WAIT_TEST is the maximum time (in seconds) to wait for a single test in parallel mass testing mode to complete. The - default is 1200. <!—
    • -
  • USLEEP_SND
    • -
  • USLEEP_REC –>
    • + default is 1200.
  • HSTS_MIN is preset to 179 (days). If you want warnings sooner or later for HTTP Strict Transport Security you can change this.
    • diff --git a/doc/testssl.1.md b/doc/testssl.1.md index 0a64b72..c817447 100644 --- a/doc/testssl.1.md +++ b/doc/testssl.1.md @@ -233,7 +233,7 @@ Also for multiple server certificates are being checked for as well as for the c ### VULNERABILITIES -`-U, --vulnerable, --vulnerabilities` Just tests all (of the following) vulnerabilities. The environment variable `VULN_THRESHLD` determines after which value a separate headline for each vulnerability is being displayed. Default is `1` which means if you check for two vulnerabilities, only the general headline for vulnerabilities section is displayed -- in addition to the vulnerability and the result. Otherwise each vulnerability or vulnerability section gets its own headline in addition to the output of the name of the vulnerability and test result. A vulnerability section is comprised of more than one check, e.g. the renegotiation vulnerability check has two checks, so has Logjam. +`-U, --vulnerable, --vulnerabilities` Just tests all (of the following) vulnerabilities. `-H, --heartbleed` Checks for Heartbleed, a memory leakage in openssl. Unless the server side doesn't support the heartbeat extension it is likely that this check runs into a timeout. The seconds to wait for a reply can be adjusted with `HEARTBLEED_MAX_WAITSOCK`. 8 is the default. @@ -243,7 +243,7 @@ Also for multiple server certificates are being checked for as well as for the c `--OP, --opossum` Checks for HTTP to HTTPS upgrade vulnerability named Opossum. -`--BB, --robot` Checks for vulnerability to ROBOT / (*Return Of Bleichenbacher's Oracle Threat*) attack. +`--BB, --robot` Checks for vulnerability to ROBOT / (*Return Of Bleichenbacher's Oracle Threat*) attack. The predefined timeout of 5 seconds can be changed with the environment variable `ROBOT_TIMEOUT`. `--SI, --starttls-injection` Checks for STARTTLS injection vulnerabilities (SMTP, IMAP, POP3 only). `socat` and OpenSSL >=1.1.0 is needed. @@ -393,6 +393,7 @@ Except the environment variables mentioned above which can replace command line * MAX_WAITSOCK: It instructs testssl.sh to wait until the specified time before declaring a socket connection dead. Don't change this unless you're absolutely sure what you're doing. Value is in seconds. * CCS_MAX_WAITSOCK Is the similar to above but applies only to the CCS handshakes, for both of the two the two CCS payload. Don't change this unless you're absolutely sure what you're doing. Value is in seconds. * HEARTBLEED_MAX_WAITSOCK Is the similar to MAX_WAITSOCK but applies only to the ServerHello after sending the Heartbleed payload. Don't change this unless you're absolutely sure what you're doing. Value is in seconds. +* ROBOT_TIMEOUT is similar to above and applies to the ROBOT check. * MEASURE_TIME_FILE For seldom cases when you don't want the scan time to be included in the output you can set this to false. * STARTTLS_SLEEP is per default set to 10 (seconds). That's the value testssl.sh waits for a string in the STARTTLS handshake before giving up. * MAX_PARALLEL is the maximum number of tests to run in parallel in parallel mass testing mode. The default value of 20 may be made larger on systems with faster processors.