2

System info:

> hostnamectl
  Operating System: Ubuntu 20.04.1 LTS
            Kernel: Linux 5.4.0-42-generic
      Architecture: x86-64

Issue: I access a self hosed nuget repostory behind a VPN for nuget packages .Net Core. When I first updated to Ubuntu 20.04, I had to lower the SSL Security level to level 1, otherwise I would receive a dh key too small error when calling dotnet restore.

I learned that 20.04 updated the minimum security level to 2, hence why it stopped working when I updated from 18.04 to 20.04. I had previously updated my /etc/ssl/openssl.cnf to include the recommended changes here: Ubuntu 20.04 - how to set lower SSL security level?.

And all seemed good, recently however, I'm getting the same dh key too small issue I previously got, even though I haven't changed my openssl.cnf.

> dotnet restore
Determining projects to restore...
  Retrying 'FindPackagesByIdAsyncCore' for source 'https://example.com/repository/nuget-group/FindPackagesById()?id='example_package'&semVerLevel=1.0.0'.
  The SSL connection could not be established, see inner exception.
    Authentication failed, see inner exception.
    SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL.
    error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small

This is the output of my openssl configs:

> cat /etc/ssl/openssl.cnf
openssl_conf = default_conf

#default config....


[ default_conf ]
ssl_conf = ssl_sect


[ ssl_sect ]
system_default = ssl_default_sect


[ ssl_default_sect ]
MinProtocol = TLSv1.2
CipherString = DEFAULT:@SECLEVEL=1

and of the currently running openssl:

> openssl version -a
OpenSSL 1.1.1f  31 Mar 2020
built on: Mon Apr 20 11:53:50 2020 UTC
platform: debian-amd64
options:  bn(64,64) rc4(16x,int) des(int) blowfish(ptr) 
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,--noexecstack -g -O2 -fdebug-prefix-map=/build/openssl-P_ODHM/openssl-1.1.1f=. -fstack-protector-strong -Wformat -Werror=format-security -DOPENSSL_TLS_SECURITY_LEVEL=2 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2
OPENSSLDIR: "/usr/lib/ssl"
ENGINESDIR: "/usr/lib/x86_64-linux-gnu/engines-1.1"
Seeding source: os-specific

and from openssl version -a I can see -DOPENSSL_TLS_SECURITY_LEVEL=2 which indicates it's running at security level 2.

I'm unable to change anything on the Nuget package repository side so I need to fix this locally. Any advice?

Lawrence Colombo
  • 121
  • 1
  • 2

1 Answers1

1

No, that tells you the default security level for the library.

openssl version -f (or -a) tells you the compilation flags that OpenSSL was compiled with:

   openssl-version - print OpenSSL version information
   -a  All information, this is the same as setting all the other flags.
   -f  Compilation flags.

And the effect of those is:

When compiling OpenSSL 1.1.0 or later, the OPENSSL_TLS_SECURITY_LEVEL option configures the default security level, which establishes default minimum security requirements for all library users.

There doesn't seem to be an obvious way to get OpenSSL to report its current effective security level using the command line. However you can (rather hackily) use the openssl ciphers -v -s command to list ciphers supported by a specific level, or the current level, and count their number to determine the current level. For example:

$ openssl ciphers -s -v ALL | wc -l
74

This tells you that you have 74 ciphers enabled in the current default configuration. Then you can try specifying various security levels:

$ openssl ciphers -s -v ALL:@SECLEVEL=0 | wc -l
86
$ openssl ciphers -s -v ALL:@SECLEVEL=1 | wc -l
74
$ openssl ciphers -s -v ALL:@SECLEVEL=2 | wc -l
74
$ openssl ciphers -s -v ALL:@SECLEVEL=3 | wc -l
58

This tells you that security levels 2 and 3 both have 74 ciphers available (i.e. they are the same on this system), so your current security level is either 2 or 3.

You can also compile a small program to call SSL_CTX_get_security_level:

cat > seclevel.c <<EOF
#include <openssl/ssl.h>

int main()
{
    SSL_CTX* ctx = SSL_CTX_new(TLS_client_method());
    printf("%d\n", SSL_CTX_get_security_level(ctx));
    return 0;
}
EOF
gcc -o seclevel seclevel.c -lssl
./seclevel

which will print the current effective security level (e.g. 2).

You can create an openssl.cnf file which overrides the default security level (such as the one in the question above), and then use this program with OPENSSL_CONF pointing to that file to check that it worked:

cat > openssl-custom.cnf
[paste example from the question above]
EOF
OPENSSL_CONF=./openssl-custom.cnf ./seclevel

Which should output 1, because the example configuration above sets SECLEVEL=1.

qris
  • 181