From c824e66ea7d052bdb845944347614da1c9ff26f6 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Thu, 7 Mar 2019 19:37:56 +0100 Subject: [PATCH] Describe configurable minimum TLS version and TLS ciphers --- .../en/admin-settings/tls-settings/_index.md | 36 +++++++++++++++++++ .../ha/helm-rancher/chart-options/_index.md | 13 +++++++ .../en/installation/single-node/_index.md | 25 ++++++++++--- 3 files changed, 69 insertions(+), 5 deletions(-) create mode 100644 content/rancher/v2.x/en/admin-settings/tls-settings/_index.md diff --git a/content/rancher/v2.x/en/admin-settings/tls-settings/_index.md b/content/rancher/v2.x/en/admin-settings/tls-settings/_index.md new file mode 100644 index 00000000000..f5cf27f0264 --- /dev/null +++ b/content/rancher/v2.x/en/admin-settings/tls-settings/_index.md @@ -0,0 +1,36 @@ +--- +title: TLS settings +weight: 11000 +--- + +_Available as of v2.1.7_ + +In Rancher v2.1.7, the default TLS configuration changed to only accept TLS 1.2 and secure TLS cipher suites. TLS 1.3 and TLS 1.3 exclusive cipher suites are not supported. + +## Configuring TLS settings + +The Audit Log is enabled and configured by passing environment variables to the Rancher server container. See the following to enable on your installation. + +- [Single Node Install - TLS settings]({{< baseurl >}}/rancher/v2.x/en/installation/single-node/#tls-settings) + +- [HA Install - TLS settings]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/#tls-settings) + +## TLS settings + +| Parameter | Description | Default | Available options | +|-----|-----|-----|-----| +| `CATTLE_TLS_MIN_VERSION` | Minimum TLS version | `1.2` | `1.0`, `1.1`, `1.2` | +| `CATTLE_TLS_CIPHERS` | Allowed TLS cipher suites | `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,`
`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,`
`TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,`
`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,`
`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,`
`TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305` | See [Golang tls constants](https://golang.org/pkg/crypto/tls/#pkg-constants) | + + +## Legacy configuration + +If you need to configure TLS the same way as it was before Rancher v2.1.7, please use the following settings: + + +| Parameter | Legacy value | +|-----|-----| +| `CATTLE_TLS_MIN_VERSION` | `1.0` | +| `CATTLE_TLS_CIPHERS` | `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,`
`TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,`
`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,`
`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,`
`TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,`
`TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,`
`TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,`
`TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,`
`TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,`
`TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,`
`TLS_RSA_WITH_AES_128_GCM_SHA256,`
`TLS_RSA_WITH_AES_256_GCM_SHA384,`
`TLS_RSA_WITH_AES_128_CBC_SHA,`
`TLS_RSA_WITH_AES_256_CBC_SHA,`
`TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,`
`TLS_RSA_WITH_3DES_EDE_CBC_SHA` + + diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md index 9931b2b35b5..f9386fc5999 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md @@ -64,6 +64,19 @@ You can set extra environment variables for Rancher server using `extraEnv`. Thi --set 'extraEnv[0].value=http://registry.example.com/' ``` +### TLS settings + +_Available as of v2.1.7_ + +To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version: + +```plain +--set 'extraEnv[0].name=CATTLE_TLS_MIN_VERSION' +--set 'extraEnv[0].value=1.0' +``` + +See [TLS settings]({{< baseurl >}}/rancher/v2.x/en/admin-settings/tls-settings) for more information and options. + ### Import `local` Cluster By default Rancher server will detect and import the `local` cluster it's running on. User with access to the `local` cluster will essentially have "root" access to all the clusters managed by Rancher server. diff --git a/content/rancher/v2.x/en/installation/single-node/_index.md b/content/rancher/v2.x/en/installation/single-node/_index.md index 62ed302c57e..5e595fa02aa 100644 --- a/content/rancher/v2.x/en/installation/single-node/_index.md +++ b/content/rancher/v2.x/en/installation/single-node/_index.md @@ -114,12 +114,24 @@ After you fulfill the prerequisites, you can install Rancher using a Let's Encry
-## FAQ and Troubleshooting - -{{< ssl_faq_single >}} - ## Advanced Options +### TLS settings + +_Available as of v2.1.7_ + +To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version: + +``` +docker run -d --restart=unless-stopped \ + -p 80:80 -p 443:443 \ + -e CATTLE_TLS_MIN_VERSION="1.0" \ + rancher/rancher:latest +``` + +See [TLS settings]({{< baseurl >}}/rancher/v2.x/en/admin-settings/tls-settings) for more information and options. + + ### Enable API Audit Log The API Audit Log records all the user and system transactions made through Rancher server. @@ -136,7 +148,6 @@ docker run -d --restart=unless-stopped \ rancher/rancher:latest ``` - ### Air Gap If you are visiting this page to complete an air gap installation, you must pre-pend your private registry URL to the server tag when running the installation command in the option that you choose. Add `` with your private registry URL in front of `rancher/rancher:latest`. @@ -164,3 +175,7 @@ docker run -d --restart=unless-stopped \ -p 8080:80 -p 8443:443 \ rancher/rancher:latest ``` + +## FAQ and Troubleshooting + +{{< ssl_faq_single >}}