cis-apache-7-12

name	cis-apache-7.12
description	Ensure Only Cipher Suites That Provide Forward Secrecy Are Enabled
category	cis-apache
version	3.6.0
author	cyberstrike-official
tags	["cis","apache","linux","ssl","tls","forward-secrecy","ciphers","ecdhe","dhe","pfs"]
cis_id	7.12
cis_benchmark	CIS Apache HTTP Server 2.2 Benchmark v3.6.0
tech_stack	["linux","apache"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure Only Cipher Suites That Provide Forward Secrecy Are Enabled

Description

In cryptography, forward secrecy (FS), which is also known as perfect forward secrecy (PFS), is a feature of specific key exchange protocols that give assurance that your session keys will not be compromised even if the private key of the server is compromised. Protocols such as RSA do not provide the forward secrecy, while the protocols ECDHE (Elliptic-Curve Diffie-Hellman Ephemeral) and the DHE (Diffie-Hellman Ephemeral) will provide forward secrecy. The ECDHE is the stronger protocol and should be preferred, while the DHE may be allowed for greater compatibility with older clients. The TLS ciphers should be configured to require either the ECDHE or the DHE ephemeral key exchange, while not allowing other cipher suites.

Rationale

During the TLS handshake, after the initial client & server Hello, there is a pre-master secret generated, which is used to generate the master secret, and in turn generates the session key. When using protocols that do not provide forward secrecy, such as RSA, the pre-master secret is encrypted by the client with the server's public key and sent over the network. However, with protocols such as ECDHE (Elliptic-Curve Diffie-Hellman Ephemeral) the pre-master secret is not sent over the wire, even in encrypted format. The key exchange arrives at the shared secret in the clear using ephemeral keys that are not stored or used again. With FS, each session has a unique key exchange, so that future sessions are protected.

Audit

Perform one of the following to determine if the recommended state is implemented:

• The SSL protocols and ciphers supported can be easily tested by connecting to a running web server with an up-to-date version of the sslscan tool. The tool is available on Kali Linux https://www.kali.org/, or via github https://github.com/rbsec/sslscan. Usage of Kali Linux for sslscan is highly recommended rather than other Linux distributions as it is important that the scan make use of an SSL library that still enables the old protocols. Current Linux versions often wisely eliminate support for older protocols such as SSLv3, and therefore may be unable to properly detect the availability of older protocols on a remote system. A statically compiled sslscan with its own openssl library that supports the older protocols may be used as well.

Check the output of sslscan, and confirm that all accepted ciphers begin with either 'ECDHE-' or 'DHE-'. Any ciphers not starting with one of the ephemeral Diffie-Hellman algorithms, is not implementing the recommended state. The sslscan command below includes regular expressions which will extract any ciphers which are not included in the recommendation. No output means that only the FS ciphers are allowed.

$ sslscan --no-colour --no-failed www.example.com | egrep
'(^Accepted)|(^Preferred)' | egrep -v '(
ECDHE-)|(  DHE-)'