UTM Up2Date 9.506 Released

Updated HA-Cluster (SG230), no issues till now. Using proxy standard mode with AD, some IPSEC, REDs, mail protection.

I have updated our production UTM for the last few days and no issues to report whatsoever. 

My home UTMs have been working fine too.

1.1

After you do: cc set reverse_proxy min_tls 1

Check the result with: grep SSLProtocol /var/chroot-reverseproxy/usr/apache/conf/reverseproxy.conf

Now is WAF still "broken" for that one situation?

Note that this probably is not supported and that you should upgrade your software to eliminate its dependence on TLSv1.  After upgrading, use the trick above to set the value back to 1.1.

Cheers - Bob

TLS 1.0 and TLS 1.1 are no longer considered safe encryption technologies, so this should not be a surprise.   However, the change should have been in the release notes.   I have complained about this before.

I infer that your problem is on the client side, since you said the problem only affects Windows 7.   Windows 7 shipped with TLS 1.0 installed but not enabled, for reasons that defy explanation.   You can turn it on by GPO or manually within Internet Options.

Reconfiguring your clients is a better idea than decreasing UTM security, but you can probably re-enable TLS 1.0 and TLS 1.1 by editing this file:

/var/chroot-reverseproxy/usr/apache/conf/httpd.conf

Change this line:

SSLProtocol +TLSv1.2
to
SSLProtocol +TLSv1.0 +TLSv1.1 +TLSv1.2

Note1:   Never enable TLS1.0 without also enabling TLS1.1    The session compatibility search functions do not like gaps in the search sequence.

Note 2:  I also recollect that Exchange 2010 had a problem with SMTP supporting nothing higher than TLS 1.0, but I believe it was corrected in one of the Exchange cumulative updates, because my configuration is connecting with TLS 1.2.  

Doug, if you look at my last post above, you'll see that this line is no longer in httpd.conf, but in reverseproxy.conf.  Unfortunately, that gets rewritten too often.  Also, if min_tls is 1.1 as Ron says, that line will look like SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2  after the cc set I mentioned.

That said, I admit that I didn't read his post closely enough to had your insight about the client.  I bet that's the best solution.

Cheers - Bob

I think I found the minimum TLS version setting, its been moved to the Web Application Firewall-Advanced tab.  I'm still seeing the option for TLS v1 or higher.  When I run cc get reverse_proxy min_tls it returns 1.

Thanks.   -Steve

Bob,

You are my HERO today!

My clients are connecting again.

Now maybe after a couple of hours outage, I can get them to get their software upgraded...

The main issue is I told them they had until April 2018 to fix this as that is the PCI compliance deadline for TLS 1.

I didn't comprehend this line in the change log:

Fix [NUTM-8806]: [WAF] Issue with TLS settings for virtual webserver

Meant removal of TLS 1...

Thanks,

Ron

Steve,

Thanks a bunch for finding that!

Not as cool as per server, but I can live with it.

Ron

My bad.

TLS 1 is still there you just need to know what screen to access.

Advanced vs Virtual Webserver/Edit Screen.

Thanks,

Ron

I guess I was writing my reply as you were writing yours.   Thanks for the updated information.

Someone Please clarify:  WAF encryption options are supposed to be configurable from the GUI, but I thought that was only for AWS environments.   Is it actually supported for all configurations in 9.506?

Just what I was looking for. I would prefer that we could set it per Virtual Web Server as before. Having it be a global setting makes all of the WAF servers insecure vs the one that still need to provide downlevel support.

Eliminating 1.0 prevented users on Android versions lower than 4.4 unable to connect to our systems. It also an older .net app we were using, but that needed to be remediated anyways. Still would have been nice to see a little bit more explanation around the changes in the change log. This entry in the release notes is a bit vague, not indicating the changes:

NUTM-8806 [WAF] Issue with TLS settings for virtual webserver

Just what I was looking for. I would prefer that we could set it per Virtual Web Server as before. Having it be a global setting makes all of the WAF servers insecure vs the one that still need to provide downlevel support.

Eliminating 1.0 prevented users on Android versions lower than 4.4 unable to connect to our systems. It also an older .net app we were using, but that needed to be remediated anyways. Still would have been nice to see a little bit more explanation around the changes in the change log. This entry in the release notes is a bit vague, not indicating the changes:

NUTM-8806 [WAF] Issue with TLS settings for virtual webserver

Rant begin:

I asked Support for more detail about a couple of these "Nutn" entries in the release notes and all they could do is point me back to the release notes.  

In a year or two, perhaps details will appear in the known issues list for this release, since the K.I.L. never seems to have current data.

Sophos does not seem to nderstand what a system manager needs and expects in a  release notes document.

Rant End