AMQP cleartext authentication

[Cameron Paige]

Hi,
I just received a vulnerability scan and it is coming back that the AMQP service allows cleartext authentication.  Logically, I looked at switching to SSL for encryption but it's asking me to provide a path to the private key.  My issue is that my client's enterprise CA won't provide me with a private key and even if they did, they wouldn't let me store that key on the server.  So one thing I tried was disabling 5672 on the external interface and only allowing communication from within the local host since that's all our custom application requires.  Unfortunately, it's still coming back with the vulnerability on the scan.  Has anyone ran into this before?  I'm running Windows 2012R2 if that helps any.

Thanks in advance.

[Michael Klishin]

On 29 February 2016 at 23:36:34, Cameron Paige (golfbal...@gmail.com) wrote:
> Logically, I looked at switching to SSL for encryption but it's
> asking me to provide a path to the private key. My issue is that
> my client's enterprise CA won't provide me with a private key
> and even if they did, they wouldn't let me store that key on the
> server. So one thing I tried was disabling 5672 on the external
> interface and only allowing communication from within the local
> host since that's all our custom application requires. Unfortunately,
> it's still coming back with the vulnerability on the scan.
 

Having node-local private keys is certainly not unheard of even in pretty paranoid environments.
We’ve heard that in some countries, financial regulations requires this (as opposed to loading keys over the network).

You could use x509 certificates only for authentication but server key would still have to be loaded
from a local FS.
--
MK

Staff Software Engineer, Pivotal/RabbitMQ

[Michael Klishin]

 On 29 February 2016 at 23:45:23, Michael Klishin (mkli...@pivotal.io) wrote:
> Having node-local private keys is certainly not unheard of
> even in pretty paranoid environments.
> We’ve heard that in some countries, financial regulations requires
> this (as opposed to loading keys over the network).

We did some more research and the runtime supports inline certificates and keys. In other
words, technically RabbitMQ could load them from any source. We could develop a plugin
that loads keys over the network, provided there's enough demand.

[Cameron Paige]

Thanks for the follow up Michael.  Greatly appreciated.  Unfortunately that still wouldn't solve our problem since our Enterprise CA won't provide us with the private key for our server certs.  Not even sure if they'd provide us with a path to where they store the keys.  Hate to say it but we're looking into MSMQ so we can leverage the windows cert store. 

[Michael Klishin]

On 2 March 2016 at 06:00:02, Cameron Paige (golfbal...@gmail.com) wrote:
> Unfortunately that still wouldn't solve our problem since
> our Enterprise CA won't provide us with the private key for our
> server certs. Not even sure if they'd provide us with a path to
> where they store the keys. Hate to say it but we're looking into
> MSMQ so we can leverage the windows cert store.

Well, that answers my questions of “where do you want to load keys  from”. Thanks.

[Cameron Paige]

Yes,  I'm definitely stuck between a rock and a hard place here.  Is there any way to leverage the windows cert store so we don't need the private key? I really don't want to move to another product but our devs can't move on without remediating this vulnerability.

Thanks again.

[Michael Klishin]

On 2 March 2016 at 17:29:04, Cameron Paige (golfbal...@gmail.com) wrote:
> Is there any way to leverage the windows cert store so we don't
> need the private key? I really don't want to move to another product
> but our devs can't move on without remediating this vulnerability.

We need to investigate if that'd be possible. RabbitMQ is very much at the mercy of
the Erlang TLS implementation and what kind of API Windows store provides.

If you have relevant Windows documentation links, please post them here.

In any case, with our current load I'd expect this to take a couple of months to be resolved.