SSLv3 issues

[gdm85]

With modern browsers I get ssl_error_inappropriate_fallback_alert (Firefox) or ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Chrome). Wget also displays:

OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
Unable to establish SSL connection.

I think SSL v3 needs to be disabled.

[xor-gate]

I think the best way is to let nginx proxy and terminate SSL in front of shellinabox. nginx has a extensive SSL configuring.

See:

• https://wiki.mozilla.org/Security/Server_Side_TLS
• https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html

Good luck

[gdm85]

@jerryjacobs the implementation of SSL that comes with shell-in-a-box should either work or be deleted. What's the point of keeping it there otherwise?

[xor-gate]

I agree on that if there is SSL support that it should work out-of-the-box without requiring other software. Proxying is also handy when different webservers/webservices need to behind one IP address and nginx is "the-facto-standard" http proxy. This issue can be solved with the SSL v2/3 disable patch but is not merged in master yet:
01be249

[gdm85]

@jerryjacobs for the records, I already know about nginx and other SSL termination solutions :) thanks for the reference to the patch, is it a patch that solves altogether the issue I reported above?

[xor-gate]

I did not test for myself yet but if you look at the addition in the patch of the OpenSSL SSL_CTX_set_cipher_list the SSL_CTX_set_options(context, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); should be working and will solve this issue.

[gdm85]

@jerryjacobs I see, but that line is in pre-existing source code not in the diff itself. Maybe you meant commit 2c8fc50

[KLuka]

@gdm85 and @jerryjacobs please see our fork of shellinabox we have this and some other stuff fixed :)

[gdm85]

@KLuka I disagree, your fork is also affected by an SSL-related issue :)

Let's continue discussion there