Prevent TLS/SSL Birthday attacks on 64-bit block ciphers (SWEET32)

Question

Our recent VA report shows that there are TLS/SSL Birthday attacks on 64-bit block ciphers possible on Kubernetes etcd ports.

Suggested solution is Configure the server to disable support for 3DES suite.

Our problems are :

Here suggest a way to access only API server to access, but I dont understand how to apply it for running kubernetes instance.

Any help, suggestions will be greatly appreciated.Also note, I am not an expert net admin.

Sachith Muhandiram · Accepted Answer · 2020-10-26 09:44:39Z

2

The cipher suites can be set via cipher-suites parameter:

$ etcd \
  --cipher-suites TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

According to here those cipher suites should be secure.

Edit :

For fixing this in running etcd in Kubernetes on Ubuntu-18.04 LTE.

edit : /etc/etcd.env add this line :

ETCD_CIPHER_SUITES=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

2234 silver badges10 bronze badges

answered Oct 25, 2020 at 15:08

Henrik Pingel

9,4702 gold badges29 silver badges39 bronze badges

docker: Error response from daemon: Conflict. The container name "/etcd1" is already in use by container "9f4c86.....". You have to remove (or rename) that container to be able to reuse that name.
– Sachith Muhandiram
Oct 25, 2020 at 15:24
1

That means that an etcd container is already running. You need to add that parameter to the service/start script/k8s deployment which manages your etcd cluster. It depends on your specific setup.
– Henrik Pingel
Oct 25, 2020 at 16:16
Sorry for bothering, where is these scripts are located? I have Ubuntu 18.04 servers with Kubernetes v1.18.5
– Sachith Muhandiram
Oct 25, 2020 at 16:43
1

Sorry, as said that depends on your setup. I usually worked with managed k8s clusters. Maybe it was setup like this: kubernetes.io/docs/setup/production-environment/tools/kubeadm/…
– Henrik Pingel
Oct 26, 2020 at 9:51
Yes, its not your fault. I added that part to make it easy for someone. Here we have baremetal servers. Its really hard to find solutions and also we are newbies for kubernetes.
– Sachith Muhandiram
Oct 26, 2020 at 10:00

Add a comment |

1 Answer 1