mirror of
https://github.com/drwetter/testssl.sh.git
synced 2025-01-30 20:31:15 +01:00
Merge branch '3.1dev' into magnuslarsen-grading_dev
This commit is contained in:
Dirk
commit
ebe75252fa
@ -13,7 +13,7 @@
|
||||
* Several display/output fixes
|
||||
* Security fix: DNS input
|
||||
* Don't use external pwd anymore
|
||||
* Rating (via SSL Labs)
|
||||
* Rating (SSL Labs, not complete)
|
||||
|
||||
### Features implemented / improvements in 3.0
|
||||
|
||||
|
||||
@ -30,9 +30,12 @@ cryptographic flaws.
|
||||
### License
|
||||
|
||||
This software is free. You can use it under the terms of GPLv2, see LICENSE.
|
||||
In addition starting from version 3.0rc1 if you're offering a scanner based on testssl.sh
|
||||
as a public and / or paid service in the internet you need to mention to your audience that you're using
|
||||
this program and where to get this program from.
|
||||
|
||||
Attribution is important for the future of this project -- also in the
|
||||
internet. Thus if you're offering a scanner based on testssl.sh as a public and/or
|
||||
paid service in the internet you are strongly encouraged to mention to your audience
|
||||
that you're using this program and where to get this program from. That helps us
|
||||
to get bugfixes, other feedback and more contributions.
|
||||
|
||||
### Compatibility
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
.\" generated with Ronn/v0.7.3
|
||||
.\" http://github.com/rtomayko/ronn/tree/0.7.3
|
||||
.
|
||||
.TH "TESTSSL" "1" "January 2020" "" ""
|
||||
.TH "TESTSSL" "1" "May 2020" "" ""
|
||||
.
|
||||
.SH "NAME"
|
||||
\fBtestssl\fR
|
||||
@ -43,13 +43,13 @@ Any OpenSSL or LibreSSL version is needed as a helper\. Unlike previous versions
|
||||
1) SSL/TLS protocol check
|
||||
.
|
||||
.P
|
||||
2) standard cipher categories to give you upfront an idea for the ciphers supported
|
||||
2) standard cipher categories
|
||||
.
|
||||
.P
|
||||
3) checks forward secrecy: ciphers and elliptical curves
|
||||
3) server\'s cipher preferences (server order?)
|
||||
.
|
||||
.P
|
||||
4) server preferences (server order)
|
||||
4) forward secrecy: ciphers and elliptical curves
|
||||
.
|
||||
.P
|
||||
5) server defaults (certificate info, TLS extensions, session information)
|
||||
@ -64,7 +64,10 @@ Any OpenSSL or LibreSSL version is needed as a helper\. Unlike previous versions
|
||||
8) testing each of 370 preconfigured ciphers
|
||||
.
|
||||
.P
|
||||
9) client simulation
|
||||
8) client simulation
|
||||
.
|
||||
.P
|
||||
9) rating
|
||||
.
|
||||
.SH "OPTIONS AND PARAMETERS"
|
||||
Options are either short or long options\. Any long or short option requiring a value can be called with or without an equal sign\. E\.g\. \fBtestssl\.sh \-t=smtp \-\-wide \-\-openssl=/usr/bin/openssl <URI>\fR (short options with equal sign) is equivalent to \fBtestssl\.sh \-\-starttls smtp \-\-wide \-\-openssl /usr/bin/openssl <URI>\fR (long option without equal sign)\. Some command line options can also be preset via ENV variables\. \fBWIDE=true OPENSSL=/usr/bin/openssl testssl\.sh \-\-starttls=smtp <URI>\fR would be the equivalent to the aforementioned examples\. Preference has the command line over any environment variables\.
|
||||
@ -238,8 +241,7 @@ session resumption capabilities,
|
||||
Time skew relative to localhost (most server implementations return random values)\.
|
||||
.
|
||||
.IP "\(bu" 4
|
||||
Several certificate information
|
||||
.RS
|
||||
.
|
||||
.IP "\(bu" 4
|
||||
signature algorithm,
|
||||
.
|
||||
@ -275,7 +277,7 @@ displaying DNS Certification Authority Authorization resource record
|
||||
.
|
||||
.IP "\(bu" 4
|
||||
Certificate Transparency info (if provided by server)\.
|
||||
.RE
|
||||
.
|
||||
.IP "" 0
|
||||
|
||||
.
|
||||
@ -409,7 +411,7 @@ Security headers (X\-Frame\-Options, X\-XSS\-Protection, Expect\-CT,\.\.\. , CSP
|
||||
.IP "" 0
|
||||
.
|
||||
.P
|
||||
Please note that in testssl\.sh 3,0 you can still use \fBrfc\fR instead of \fBiana\fR and \fBno\-rfc\fR instead of \fBno\-iana\fR but it\'ll disappear after 3\.0\.
|
||||
Please note that in testssl\.sh 3\.0 you can still use \fBrfc\fR instead of \fBiana\fR and \fBno\-rfc\fR instead of \fBno\-iana\fR but it\'ll disappear after 3\.0\.
|
||||
.
|
||||
.P
|
||||
\fB\-\-show\-each\fR This is an option for all wide modes only: it displays all ciphers tested \-\- not only succeeded ones\. \fBSHOW_EACH_C\fR is your friend if you prefer to set this via the shell environment\.
|
||||
@ -443,6 +445,9 @@ whole 9 yards
|
||||
.
|
||||
.IP "" 0
|
||||
.
|
||||
.P
|
||||
\fB\-\-disable\-rating\fR disables rating\. Rating automatically gets disabled, to not give a wrong or misleading grade, when not all required functions are executed (e\.g when checking for a single vulnerabilities)\.
|
||||
.
|
||||
.SS "FILE OUTPUT OPTIONS"
|
||||
\fB\-\-log, \-\-logging\fR Logs stdout also to \fB${NODE}\-p${port}${YYYYMMDD\-HHMM}\.log\fR in current working directory of the shell\. Depending on the color output option (see above) the output file will contain color and other markup escape codes, unless you specify \fB\-\-color 0\fR too\. \fBcat\fR and \-\- if properly configured \fBless\fR \-\- will show the output properly formatted on your terminal\. The output shows a banner with the almost the same information as on the screen\. In addition it shows the command line of the testssl\.sh instance\. Please note that the resulting log file is formatted according to the width of your screen while running testssl\.sh\. You can override the width with the environment variable TERM_WIDTH\.
|
||||
.
|
||||
@ -626,6 +631,30 @@ MAX_HEADER_FAIL: A number which tells testssl\.sh how often a HTTP GET request o
|
||||
.
|
||||
.IP "" 0
|
||||
.
|
||||
.SS "RATING"
|
||||
This program has a near\-complete implementation of SSL Labs\'s \'SSL Server Rating Guide \fIhttps://github\.com/ssllabs/research/wiki/SSL\-Server\-Rating\-Guide\fR\'\.
|
||||
.
|
||||
.P
|
||||
This is \fInot\fR a 100% reimplementation of the SSL Lab\'s SSL Server Test \fIhttps://www\.ssllabs\.com/ssltest/analyze\.html\fR, but an implementation of the above rating specification, slight discrepancies may occur\. Please note that for now we stick to the SSL Labs rating as good as possible\. We are not responsible for their rating\. Before filing issues please inspect their Rating Guide\.
|
||||
.
|
||||
.P
|
||||
Disclaimer: Having a good grade is \fBNOT\fR necessarily equal to having good security! Don\'t start a competition for the best grade, at least not without monitoring the client handshakes and not without adding a portion of good sense to it\.
|
||||
.
|
||||
.P
|
||||
As of writing, these checks are missing: * GOLDENDOODLE \- should be graded \fBF\fR if vulnerable * Insecure renegotiation \- should be graded \fBF\fR if vulnerable * Padding oracle in AES\-NI CBC MAC check (CVE\-2016\-2107) \- should be graded \fBF\fR if vulnerable * Sleeping POODLE \- should be graded \fBF\fR if vulnerable * Zero Length Padding Oracle (CVE\-2019\-1559) \- should be graded \fBF\fR if vulnerable * Zombie POODLE \- should be graded \fBF\fR if vulnerable * All remaining old Symantec PKI certificates are distrusted \- should be graded \fBT\fR * Symantec certificates issued before June 2016 are distrusted \- should be graded \fBT\fR * ! A reading of DH params \- should give correct points in \fBset_key_str_score()\fR * Anonymous key exchange \- should give \fB0\fR points in \fBset_key_str_score()\fR * Exportable key exchange \- should give \fB40\fR points in \fBset_key_str_score()\fR * Weak key (Debian OpenSSL Flaw) \- should give \fB0\fR points in \fBset_key_str_score()\fR
|
||||
.
|
||||
.P
|
||||
To implement a new grading cap, simply call the \fBset_grade_cap()\fR function, with the grade and a reason: \fBbash set_grade_cap "D" "Vulnerable to documentation"\fR To implement a new grade warning, simply call the \fBset_grade_warning()\fR function, with a message: \fBbash set_grade_warning "Documentation is always right"\fR
|
||||
.
|
||||
.P
|
||||
When implementing a new check (be it vulnerability or not) that sets grade caps, the \fBset_rating_state()\fR has to be updated (i\.e\. the \fB$do_mycheck\fR variable\-name has to be added to the loop, and \fB$nr_enabled\fR if\-statement has to be incremented)
|
||||
.
|
||||
.P
|
||||
The \fBset_rating_state()\fR automatically disables ratinng, if all the required checks are \fInot\fR enabled\. This is to prevent giving out a misleading or wrong grade\.
|
||||
.
|
||||
.P
|
||||
When a new revision of the rating specification comes around, the following has to be done: * New grade caps has to be either: 1\. Added to the script wherever relevant, or 2\. Added to the above list of missing checks (if \fIi\.\fR is not possible) * New grade warnings has to be added wherever relevant * The revision output in \fBrun_rating()\fR function has to updated
|
||||
.
|
||||
.SH "EXAMPLES"
|
||||
.
|
||||
.nf
|
||||
@ -635,7 +664,7 @@ MAX_HEADER_FAIL: A number which tells testssl\.sh how often a HTTP GET request o
|
||||
.fi
|
||||
.
|
||||
.P
|
||||
does a default run on https://testssl\.sh (protocols, standard cipher lists, FS, server preferences, server defaults, vulnerabilities, testing all known 370 ciphers, client simulation\.
|
||||
does a default run on https://testssl\.sh (protocols, standard cipher lists, server\'s cipher preferences, forward secrecy, server defaults, vulnerabilities, client simulation, and rating\.
|
||||
.
|
||||
.IP "" 4
|
||||
.
|
||||
|
||||
@ -121,11 +121,11 @@ linked OpenSSL binaries for major operating systems are supplied in <code>./bin/
|
||||
|
||||
<p>1) SSL/TLS protocol check</p>
|
||||
|
||||
<p>2) standard cipher categories to give you upfront an idea for the ciphers supported</p>
|
||||
<p>2) standard cipher categories</p>
|
||||
|
||||
<p>3) checks forward secrecy: ciphers and elliptical curves</p>
|
||||
<p>3) server's cipher preferences (server order?)</p>
|
||||
|
||||
<p>4) server preferences (server order)</p>
|
||||
<p>4) forward secrecy: ciphers and elliptical curves</p>
|
||||
|
||||
<p>5) server defaults (certificate info, TLS extensions, session information)</p>
|
||||
|
||||
@ -133,9 +133,9 @@ linked OpenSSL binaries for major operating systems are supplied in <code>./bin/
|
||||
|
||||
<p>7) vulnerabilities</p>
|
||||
|
||||
<p>8) testing each of 370 preconfigured ciphers</p>
|
||||
<p>8) client simulation</p>
|
||||
|
||||
<p>9) client simulation</p>
|
||||
<p>9) rating</p>
|
||||
|
||||
<h2 id="OPTIONS-AND-PARAMETERS">OPTIONS AND PARAMETERS</h2>
|
||||
|
||||
@ -185,7 +185,7 @@ The same can be achieved by setting the environment variable <code>WARNINGS</cod
|
||||
|
||||
<p><code>--openssl-timeout <seconds></code> This is especially useful for all connects using openssl and practically useful for mass testing. It avoids the openssl connect to hang for ~2 minutes. The expected parameter <code>seconds</code> instructs testssl.sh to wait before the openssl connect will be terminated. The option is only available if your OS has a timeout binary installed. As there are different implementations of <code>timeout</code>: It automatically calls the binary with the right parameters. OPENSSL_TIMEOUT is the equivalent environment variable.</p>
|
||||
|
||||
<p><code>--basicauth <user:pass></code> This can be set to provide HTTP basic auth credentials which are used during checks for security headers. BASICAUTH is the ENV variable you can use instead.</p>
|
||||
<p><code>--basicauth <user:pass></code> This can be set to provide HTTP basic auth credentials which are used during checks for security headers. BASICAUTH is the ENV variable you can use instead.</p>
|
||||
|
||||
<h3 id="SPECIAL-INVOCATIONS">SPECIAL INVOCATIONS</h3>
|
||||
|
||||
@ -357,7 +357,7 @@ Also for multiple server certificates are being checked for as well as for the c
|
||||
</ul>
|
||||
|
||||
|
||||
<p>Please note that in testssl.sh 3,0 you can still use <code>rfc</code> instead of <code>iana</code> and <code>no-rfc</code> instead of <code>no-iana</code> but it'll disappear after 3.0.</p>
|
||||
<p>Please note that in testssl.sh 3.0 you can still use <code>rfc</code> instead of <code>iana</code> and <code>no-rfc</code> instead of <code>no-iana</code> but it'll disappear after 3.0.</p>
|
||||
|
||||
<p><code>--show-each</code> This is an option for all wide modes only: it displays all ciphers tested -- not only succeeded ones. <code>SHOW_EACH_C</code> is your friend if you prefer to set this via the shell environment.</p>
|
||||
|
||||
@ -377,6 +377,9 @@ Also for multiple server certificates are being checked for as well as for the c
|
||||
</ol>
|
||||
|
||||
|
||||
<p><code>--disable-rating</code> disables rating.
|
||||
Rating automatically gets disabled, to not give a wrong or misleading grade, when not all required functions are executed (e.g when checking for a single vulnerabilities).</p>
|
||||
|
||||
<h3 id="FILE-OUTPUT-OPTIONS">FILE OUTPUT OPTIONS</h3>
|
||||
|
||||
<p><code>--log, --logging</code> Logs stdout also to <code>${NODE}-p${port}${YYYYMMDD-HHMM}.log</code> in current working directory of the shell. Depending on the color output option (see above) the output file will contain color and other markup escape codes, unless you specify <code>--color 0</code> too. <code>cat</code> and -- if properly configured <code>less</code> -- will show the output properly formatted on your terminal. The output shows a banner with the almost the same information as on the screen. In addition it shows the command line of the testssl.sh instance. Please note that the resulting log file is formatted according to the width of your screen while running testssl.sh. You can override the width with the environment variable TERM_WIDTH.</p>
|
||||
@ -475,12 +478,61 @@ Also for multiple server certificates are being checked for as well as for the c
|
||||
</ul>
|
||||
|
||||
|
||||
<h3 id="RATING">RATING</h3>
|
||||
|
||||
<p>This program has a near-complete implementation of SSL Labs's '<a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide">SSL Server Rating Guide</a>'.</p>
|
||||
|
||||
<p>This is <em>not</em> a 100% reimplementation of the <a href="https://www.ssllabs.com/ssltest/analyze.html">SSL Lab's SSL Server Test</a>, but an implementation of the above rating specification, slight discrepancies may occur. Please note that for now we stick to the SSL Labs rating as good as possible. We are not responsible for their rating. Before filing issues please inspect their Rating Guide.</p>
|
||||
|
||||
<p>Disclaimer: Having a good grade is <strong>NOT</strong> necessarily equal to having good security! Don't start a competition for the best grade, at least not without monitoring the client handshakes and not without adding a portion of good sense to it.</p>
|
||||
|
||||
<p>As of writing, these checks are missing:
|
||||
* GOLDENDOODLE - should be graded <strong>F</strong> if vulnerable
|
||||
* Insecure renegotiation - should be graded <strong>F</strong> if vulnerable
|
||||
* Padding oracle in AES-NI CBC MAC check (CVE-2016-2107) - should be graded <strong>F</strong> if vulnerable
|
||||
* Sleeping POODLE - should be graded <strong>F</strong> if vulnerable
|
||||
* Zero Length Padding Oracle (CVE-2019-1559) - should be graded <strong>F</strong> if vulnerable
|
||||
* Zombie POODLE - should be graded <strong>F</strong> if vulnerable
|
||||
* All remaining old Symantec PKI certificates are distrusted - should be graded <strong>T</strong>
|
||||
* Symantec certificates issued before June 2016 are distrusted - should be graded <strong>T</strong>
|
||||
* ! A reading of DH params - should give correct points in <code>set_key_str_score()</code>
|
||||
* Anonymous key exchange - should give <strong>0</strong> points in <code>set_key_str_score()</code>
|
||||
* Exportable key exchange - should give <strong>40</strong> points in <code>set_key_str_score()</code>
|
||||
* Weak key (Debian OpenSSL Flaw) - should give <strong>0</strong> points in <code>set_key_str_score()</code></p>
|
||||
|
||||
<h4 id="Implementing-new-grades-caps-or-warnings">Implementing new grades caps or -warnings</h4>
|
||||
|
||||
<p>To implement a new grading cap, simply call the <code>set_grade_cap()</code> function, with the grade and a reason:
|
||||
<code>bash
|
||||
set_grade_cap "D" "Vulnerable to documentation"
|
||||
</code>
|
||||
To implement a new grade warning, simply call the <code>set_grade_warning()</code> function, with a message:
|
||||
<code>bash
|
||||
set_grade_warning "Documentation is always right"
|
||||
</code></p>
|
||||
|
||||
<h4 id="Implementing-a-new-check-which-contains-grade-caps">Implementing a new check which contains grade caps</h4>
|
||||
|
||||
<p>When implementing a new check (be it vulnerability or not) that sets grade caps, the <code>set_rating_state()</code> has to be updated (i.e. the <code>$do_mycheck</code> variable-name has to be added to the loop, and <code>$nr_enabled</code> if-statement has to be incremented)</p>
|
||||
|
||||
<p>The <code>set_rating_state()</code> automatically disables ratinng, if all the required checks are <em>not</em> enabled.
|
||||
This is to prevent giving out a misleading or wrong grade.</p>
|
||||
|
||||
<h4 id="Implementing-a-new-revision">Implementing a new revision</h4>
|
||||
|
||||
<p>When a new revision of the rating specification comes around, the following has to be done:
|
||||
* New grade caps has to be either:
|
||||
1. Added to the script wherever relevant, or
|
||||
2. Added to the above list of missing checks (if <em>i.</em> is not possible)
|
||||
* New grade warnings has to be added wherever relevant
|
||||
* The revision output in <code>run_rating()</code> function has to updated</p>
|
||||
|
||||
<h2 id="EXAMPLES">EXAMPLES</h2>
|
||||
|
||||
<pre><code> testssl.sh testssl.sh
|
||||
</code></pre>
|
||||
|
||||
<p>does a default run on https://testssl.sh (protocols, standard cipher lists, FS, server preferences, server defaults, vulnerabilities, testing all known 370 ciphers, client simulation.</p>
|
||||
<p>does a default run on https://testssl.sh (protocols, standard cipher lists, server's cipher preferences, forward secrecy, server defaults, vulnerabilities, client simulation, and rating.</p>
|
||||
|
||||
<pre><code> testssl.sh testssl.net:443
|
||||
</code></pre>
|
||||
@ -606,7 +658,7 @@ where to get this program from.</p>
|
||||
|
||||
<ol class='man-decor man-foot man foot'>
|
||||
<li class='tl'></li>
|
||||
<li class='tc'>January 2020</li>
|
||||
<li class='tc'>May 2020</li>
|
||||
<li class='tr'>testssl(1)</li>
|
||||
</ol>
|
||||
|
||||
|
||||
@ -40,11 +40,11 @@ linked OpenSSL binaries for major operating systems are supplied in `./bin/`.
|
||||
|
||||
1) SSL/TLS protocol check
|
||||
|
||||
2) checks forward secrecy: ciphers and elliptical curves
|
||||
2) standard cipher categories
|
||||
|
||||
3) standard cipher categories to give you upfront an idea for the ciphers supported
|
||||
3) server's cipher preferences (server order?)
|
||||
|
||||
4) server preferences (server order)
|
||||
4) forward secrecy: ciphers and elliptical curves
|
||||
|
||||
5) server defaults (certificate info, TLS extensions, session information)
|
||||
|
||||
@ -56,7 +56,8 @@ linked OpenSSL binaries for major operating systems are supplied in `./bin/`.
|
||||
|
||||
8) client simulation
|
||||
|
||||
9) Result of script in form of a grade
|
||||
9) rating
|
||||
|
||||
|
||||
|
||||
## OPTIONS AND PARAMETERS
|
||||
@ -269,7 +270,7 @@ Also for multiple server certificates are being checked for as well as for the c
|
||||
* `no-openssl`: don't display the OpenSSL cipher suite name, display IANA names only.
|
||||
* `no-iana`: don't display the IANA cipher suite name, display OpenSSL names only.
|
||||
|
||||
Please note that in testssl.sh 3,0 you can still use `rfc` instead of `iana` and `no-rfc` instead of `no-iana` but it'll disappear after 3.0.
|
||||
Please note that in testssl.sh 3.0 you can still use `rfc` instead of `iana` and `no-rfc` instead of `no-iana` but it'll disappear after 3.0.
|
||||
|
||||
`--show-each` This is an option for all wide modes only: it displays all ciphers tested -- not only succeeded ones. `SHOW_EACH_C` is your friend if you prefer to set this via the shell environment.
|
||||
|
||||
@ -288,8 +289,8 @@ Please note that in testssl.sh 3,0 you can still use `rfc` instead of `iana` and
|
||||
5. display bytes received via sockets
|
||||
6. whole 9 yards
|
||||
|
||||
`--disable-rating` disables rating explicitly.
|
||||
Grading automatically gets disabled, to not give a wrong or misleading grade, when not all required functions are executed (e.g when checking for a single vulnerabilities).
|
||||
`--disable-rating` disables rating.
|
||||
Rating automatically gets disabled, to not give a wrong or misleading grade, when not all required functions are executed (e.g when checking for a single vulnerabilities).
|
||||
|
||||
|
||||
### FILE OUTPUT OPTIONS
|
||||
@ -435,7 +436,7 @@ When a new revision of the rating specification comes around, the following has
|
||||
|
||||
testssl.sh testssl.sh
|
||||
|
||||
does a default run on https://testssl.sh (protocols, standard cipher lists, server's cipher preferences, FS, server defaults, vulnerabilities, client simulation, and rating.
|
||||
does a default run on https://testssl.sh (protocols, standard cipher lists, server's cipher preferences, forward secrecy, server defaults, vulnerabilities, client simulation, and rating.
|
||||
|
||||
testssl.sh testssl.net:443
|
||||
|
||||
|
||||
675
testssl.sh
675
testssl.sh
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue
Block a user