HTTP/HTTPS Redirection and SSL Config

[tiger...@ahamobile.com]

Hello All

I installed Sonar 5.2 with Linux native package (http://downloads.sourceforge.net/project/sonar-pkg/rpm/sonar.repo) and configure it to bind on HTTPS port 443 (through authbind).

I have two questions:

1. How to redirect HTTP to HTTPS?
2. How improve the SSLLab Rating (https://www.ssllabs.com/ssltest/)? There are two SSL issues I'd like to address:
• This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B.
• The server does not support Forward Secrecy with the reference browsers.  

Thanks,
Tiger

[Simon Brandhof]

Hi Tiger,

1. How to redirect HTTP to HTTPS?

No it's not possible natively. You should install a proxy.

1. How improve the SSLLab Rating (https://www.ssllabs.com/ssltest/)? There are two SSL issues I'd like to address:
• This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B.
• The server does not support Forward Secrecy with the reference browsers.  

https://nemo.sonarqube.org is grade A at ssllabs.com with current development version of SonarQube. I recommend to upgrade to version 5.3 and use the latest version of Java 8. 

For disabling the weak Diffie-Hellman ciphers, you should use the property "sonar.web.https.ciphers" defined in conf/sonar.properties. 

Regards

[Simon Brandhof]

In fact I'm not sure that nemo.sonarqube.org uses the native HTTPS support of SonarQube. I will get back to you when I have some news from our ops team.

Simon BRANDHOF | SonarSource

Tech Lead & Co-Founder
http://twitter.com/SimonBrandhof

[Michel Pawlak]

Hi,

These two vulnerabilities ar not related at all to the version of SQ, but to the list of encryption cyphers that are allowed by the server. At least since mid January 2015 and version 4.5.4), we can specify ciphers that are allowed in SonarQube. we have to configure properly sonar.web.https.ciphers in sonar.properties otherwise, as stated in the file, default values for the JVM will be used, which can lead to vulnerabilities.

@Simon, is there a specific reason for telling Tiger to update to 5.3 in this context? Isn't it sufficient to specify the ciphers that have to be allowed?

Back to the two vulnerabilities Tiger is facing:

• "This server supports weak Diffie-Hellman (DH) key exchange parameters" indicates that the server is vulnerable to the Logjam attack (see https://weakdh.org/). Qualys has published a guide in order to help you deploy correctly Diffie-Hellman, you should read it : https://weakdh.org/sysadmin.html
• "The server does not support Forward Secrecy with the reference browsers" means that you have to support ECDHE (as for the Logjam vulnerability by the way) (see https://community.qualys.com/blogs/securitylabs/2013/06/25/ssl-labs-deploying-forward-secrecy)

@Tiger, what I would do is select the right ciphers to allow based on these two posts:

1. https://community.qualys.com/message/26366#26366
   
2. https://community.qualys.com/message/26367#26367

Michel

[Simon Brandhof]

@Simon, is there a specific reason for telling Tiger to update to 5.3 in this context? Isn't it sufficient to specify the ciphers that have to be allowed?

Hi Michel, each new version may fix vulnerability issues and upgrade Tomcat for instance. I didn't check 5.3 compared to 5.2, so no specific reason to upgrade indeed.