保護tomcat7 - 禁用RC4不起作用

Question

我試圖保護我的tomcat 7安裝程序。我目前有兩個問題來這裏第一個：

我基本上使用默認配置，我只是擴展ssl配置得到SSL Labs A評級。

我的問題是我想禁用RC4，因爲它是不安全的，所以我添加了我信任的密碼套件（它是list of Mozilla），它以!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK結尾，這意味着AFIK不應該使用那些算法。但RC4仍然在這裏使用是我的完整配置（沒有評論）：

<Server port="8005" shutdown="SHUTDOWN"> 
<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" /> 
    <Listener className="org.apache.catalina.core.JasperListener" /> 
    <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" /> 
    <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" /> 
    <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" /> 
    <GlobalNamingResources> 
    <Resource name="UserDatabase" auth="Container" 
       type="org.apache.catalina.UserDatabase" 
       description="User database that can be updated and saved" 
       factory="org.apache.catalina.users.MemoryUserDatabaseFactory" 
       pathname="conf/tomcat-users.xml" /> 
    </GlobalNamingResources> 
    <Service name="Catalina"> 
    <Connector port="8080" protocol="HTTP/1.1" 
       connectionTimeout="20000" 
       URIEncoding="UTF-8" 
       redirectPort="8443" /> 
    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" 
       maxThreads="150" SSLEnabled="true" scheme="https" secure="true" 
       clientAuth="false" sslProtocol="TLS" SSLHonorCipherOrder="true" 
       SSLDisableCompression="true" SSLCipherSuite="ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK" 
       SSLCertificateChainFile="/root/ca.crt" 
       SSLCACertificatePath="/etc/ssl/certs" 
       keystoreFile="/path/to/keystore" keystorePass="pwd" /> 
    <Engine name="Catalina" defaultHost="localhost"> 
     <Realm className="org.apache.catalina.realm.LockOutRealm"> 
     <Realm className="org.apache.catalina.realm.UserDatabaseRealm" 
       resourceName="UserDatabase"/> 
     </Realm> 

     <Host name="localhost" appBase="webapps" 
      unpackWARs="true" autoDeploy="true"> 
     <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" 
       prefix="localhost_access_log." suffix=".txt" 
       pattern="%h %l %u %t &quot;%r&quot; %s %b" /> 

     </Host> 
    </Engine> 
    </Service> 
</Server> 

如果你知道我做錯了什麼，請通知我。

Answer 1

您已將您的密碼套件列表格式化爲與使用APR/OpenSSL一樣，但仍配置爲使用NIO連接器，該連接器將依賴於Java進行連接，因此需要該密碼的格式名單。將您的首選套件放入一個以逗號分隔的列表中（沒有套房類型，只有顯式配置），重新啓動，並查看是否無法爲您解決問題。

甲骨文的Java 8密碼名稱可以在這裏找到：http://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html

您可以使用此連接器：

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" 
      maxThreads="150" SSLEnabled="true" scheme="https" secure="true" 
      clientAuth="false" sslProtocol="TLS" SSLHonorCipherOrder="true" 
      SSLDisableCompression="true" ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA" 
      keystoreFile="/path/to/keystore" keystorePass="pwd" />