the-littlest-jupyterhub
the-littlest-jupyterhub copied to clipboard
Specify ciphersuites in TLS config
We should probably explicitly specify our ciphersuites in traefik config.
Just as an FYI for anyone that may come across a similar issue, our VM team flagged us on use of an insecure cipher suite related to CVE-2016-2183 even after setting the minimum TLS version to v1.2, In our case we specified several suites in the traefik.toml config as a fix, e.g.
minVersion = "VersionTLS12"
cipherSuites = [
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_RSA_WITH_AES_128_GCM_SHA256",
"TLS_RSA_WITH_AES_256_GCM_SHA384",
"TLS_RSA_WITH_AES_128_CBC_SHA",
"TLS_RSA_WITH_AES_256_CBC_SHA"
]
Originally posted by @aye-aye-aye in https://github.com/jupyterhub/the-littlest-jupyterhub/issues/488#issuecomment-587454858
This kind of change should probably be in sync with the equivalent logic for Traefik in z2jh.