TLS: Cipher Specific hardening for a Posit server

Follow

When hardening your Posit servers, there are a number of options available:


Posit Workbench: https://docs.posit.co/ide/server-pro/access_and_security

Posit Connect: https://docs.posit.co/connect/admin/security/#strong-https

Posit Package Manager: https://docs.posit.co/rspm/admin/security

 

To this end, our most common support request is for stronger HTTPS protocols. Each product has an  allowance for broad-stroke TLS version configuration:


In Workbench:  

# /etc/rstudio/rserver.conf
ssl-protocols=TLSv1.2 TLSv1.3

https://docs.posit.co/ide/server-pro/access_and_security/secure_sockets.html#ssl-protocols


In Connect:

# /etc/rstudio/rstudio-connect.gcfg

[HTTPS] Listen = 443 MinimumTLS = 1.2

https://docs.posit.co/connect/admin/security/#strong-https


In Package Manager:

# /etc/rstudio-pm/rstudio-pm.gcfg

[HTTPS]
Listen = 443
MinimumTLS = 1.2  

https://docs.posit.co/rspm/admin/security/#strong-https

 

With Connect and Package Manager, we are often asked for fine-grained, per-cipher, exclusion options - here is what this type of request might look like:


"We need to disable TLSv1.1 and we need to disable DES, 3DES, IDEA, and RC2 ciphers, on our HTTPS/SSL enabled RStudio Package Manager instance."


Unfortunately, due to decisions outside of our control(1) we no longer offer the HTTPS.ExcludedCiphers configuration option, and our advice is putting the server behind a reverse proxy and utilising that proxy's cipher suite modules.


This document will go through the setting up of both nginx and apache2 proxies, and how to then configure each of Connect and Package Manager accordingly.


Using nginx as a reverse proxy


Connect

Using what we know from the simple Connect and proxy set up, we will add the necessary lines to the appropriate nginx configuration file.


First, set up the nginx configuration per the appropriate documentation:
https://docs.posit.co/connect/admin/proxy/#simple-configuration


Then, using the ssl_ciphers syntax
http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers

 

and using the openssl library's format described here:
https://www.openssl.org/docs/man1.1.1/man1/ciphers.html


For the above request "we need to disable DES, 3DES, IDEA, and RC2 ciphers", this is what we want to see:

 

http {
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''    close;
    }
    server {
        listen 80;
        client_max_body_size 0; # Disables checking of client request body size
        ssl_prefer_server_ciphers on;
        ssl_ciphers -DES:-3DES:-IDEA:-RC2;

        location / {
            proxy_set_header X-RSC-Request $scheme://$http_host$request_uri;
            proxy_pass http://localhost:3939;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_http_version 1.1;
            proxy_buffering off; # Required for XHR-streaming
        }
    }
}


Note that we have added the directive ssl_prefer_server_ciphers as well - this is because a server will naturally default to the client's cipher choice.


Package Manager


For Package Manager, it will be the same two lines, added to the appropriate nginx configuration:
https://docs.posit.co/rspm/admin/proxy/#nginx-configuration

 

  http {
    map $http_upgrade $connection_upgrade {
      default upgrade;
      ''  close;
  }
    server {
      listen 80;
      ssl_prefer_server_ciphers on;
      ssl_ciphers -DES:-3DES:-IDEA:-RC2;
      location / {
        proxy_set_header X-RSPM-Request
        $scheme://$host:$server_port$request_uri;
        proxy_pass <http://localhost:4242>;
    }
  }
}


Using Apache as a reverse proxy

Connect

Using what we know from the simple Connect and proxy set up, we will add the necessary lines to the appropriate apache configuration file.


First, set up the apache configuration per the appropriate documentation:
https://docs.posit.co/connect/admin/proxy/#simple-configuration_1


Then, using the SSLCipherSuite syntax
https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html#onlystrong


and using the openssl library's format described here:
https://www.openssl.org/docs/man1.1.1/man1/ciphers.html

For the above request "we need to disable DES, 3DES, IDEA, and RC2 ciphers", this is what we want to see:

 

  LoadModule ssl_module modules/mod_ssl.so
  Listen 80
  
  <VirtualHost *:80>
  SSLCipherSuite -DES:-3DES:-IDEA:-RC2
  
RewriteEngine on # store variable values with dummy rewrite rules RewriteRule . - [E=req_scheme:%{REQUEST_SCHEME}] RewriteRule . - [E=http_host:%{HTTP_HOST}] RewriteRule . - [E=req_uri:%{REQUEST_URI}] # set header with variables RequestHeader set X-RSC-Request "%{req_scheme}e://%{http_host}e%{req_uri}e" # unprefixed websocket proxying RewriteCond %{HTTP:Upgrade} websocket [NC] RewriteCond %{HTTP:Connection} upgrade [NC] RewriteRule ^/(.*) "ws://localhost:3939/$1" [P,L] <Location /> ProxyPass http://localhost:3939/ connectiontimeout=5 </Location> </VirtualHost>

 

Package Manager


For Package Manager, it will be the same two lines, added to the appropriate apache configuration:

https://docs.posit.co/rspm/admin/proxy/#apache-configuration

 

  LoadModule ssl_module modules/mod_ssl.so
  Listen 3737

  <VirtualHost *:3737>
    SSLCipherSuite -DES:-3DES:-IDEA:-RC2
    RewriteEngine on
    RequestHeader set X-RSPM-Request "%{REQUEST_SCHEME}s://%{HTTP_HOST}s%{REQUEST_URI}s"
    ProxyPass / <http://172.17.0.1:4242/>
    ProxyPassReverse / <http://172.17.0.1:4242/>
  </VirtualHost>

 

These are relatively simple changes to implement - if you have a need to cipher specific hardening, this is the process Posit will recommend.

 

1: See this discussion in the Go language about removing per-cipher exclusions:

https://github.com/golang/go/issues/29349

 

 

 

Comments