RANGER-3153: Updated TLS version to 1.2 for ranger

apache · Jan 28, 2021 · 5df5124 · 5df5124
1 parent 47cfd46
commit 5df5124
Show file tree

Hide file tree

Showing 5 changed files with 9 additions and 9 deletions.
diff --git a/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServer.java b/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServer.java
@@ -77,7 +77,7 @@ public class EmbeddedServer {
 	private static final String KMS_SERVER_NAME   = "rangerkms";
 	public static final String RANGER_KEYSTORE_FILE_TYPE_DEFAULT = KeyStore.getDefaultType();
 	public static final String RANGER_TRUSTSTORE_FILE_TYPE_DEFAULT = KeyStore.getDefaultType();
-	public static final String RANGER_SSL_CONTEXT_ALGO_TYPE = "TLS";
+	public static final String RANGER_SSL_CONTEXT_ALGO_TYPE = "TLSv1.2";
 	public static final String RANGER_SSL_KEYMANAGER_ALGO_TYPE = KeyManagerFactory.getDefaultAlgorithm();
 	public static final String RANGER_SSL_TRUSTMANAGER_ALGO_TYPE = TrustManagerFactory.getDefaultAlgorithm();
 
@@ -151,7 +151,7 @@ public void start() {
 			ssl.setSecure(true);
 			ssl.setScheme("https");
 			ssl.setAttribute("SSLEnabled", "true");
-			ssl.setAttribute("sslProtocol", EmbeddedServerUtil.getConfig("ranger.service.https.attrib.ssl.protocol", "TLS"));
+			ssl.setAttribute("sslProtocol", EmbeddedServerUtil.getConfig("ranger.service.https.attrib.ssl.protocol", "TLSv1.2"));
 			ssl.setAttribute("keystoreType", EmbeddedServerUtil.getConfig("ranger.keystore.file.type", RANGER_KEYSTORE_FILE_TYPE_DEFAULT));
 			ssl.setAttribute("truststoreType", EmbeddedServerUtil.getConfig("ranger.truststore.file.type", RANGER_TRUSTSTORE_FILE_TYPE_DEFAULT));
 			String clientAuth = EmbeddedServerUtil.getConfig("ranger.service.https.attrib.clientAuth", "false");
@@ -172,7 +172,7 @@ public void start() {
 			ssl.setAttribute("keystorePass", keystorePass);
 			ssl.setAttribute("keystoreFile", getKeystoreFile());
 
-			String defaultEnabledProtocols = "SSLv2Hello, TLSv1, TLSv1.1, TLSv1.2";
+			String defaultEnabledProtocols = "TLSv1.2";
 			String enabledProtocols = EmbeddedServerUtil.getConfig("ranger.service.https.attrib.ssl.enabled.protocols", defaultEnabledProtocols);
 			ssl.setAttribute("sslEnabledProtocols", enabledProtocols);
 			String ciphers = EmbeddedServerUtil.getConfig("ranger.tomcat.ciphers");

diff --git a/security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml b/security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml
@@ -288,7 +288,7 @@
 
 	<property>
 		<name>ranger.service.https.attrib.ssl.protocol</name>
-		<value>TLS</value>
+		<value>TLSv1.2</value>
 	</property>
 
 	<property>
@@ -592,7 +592,7 @@
 	</property>
         <property>
                 <name>ranger.service.https.attrib.ssl.enabled.protocols</name>
-                <value>SSLv2Hello, TLSv1, TLSv1.1, TLSv1.2</value>
+                <value>TLSv1.2</value>
         </property>
         <!-- Encryption -->
        <property>

diff --git a/ugsync/src/main/java/org/apache/ranger/ldapusersync/process/CustomSSLSocketFactory.java b/ugsync/src/main/java/org/apache/ranger/ldapusersync/process/CustomSSLSocketFactory.java
@@ -104,7 +104,7 @@ public CustomSSLSocketFactory() {
 				}
 			}
 
-			sslContext = SSLContext.getInstance("TLS");
+			sslContext = SSLContext.getInstance("TLSv1.2");
 
 			sslContext.init(kmList, tmList, new SecureRandom());
 			sockFactory = sslContext.getSocketFactory();

diff --git a/unixauthservice/conf.dist/ranger-ugsync-default.xml b/unixauthservice/conf.dist/ranger-ugsync-default.xml
@@ -27,7 +27,7 @@
 	</property>
 	<property>
 		<name>ranger.usersync.https.ssl.enabled.protocols</name>
-		<value>SSLv2Hello, TLSv1, TLSv1.1, TLSv1.2</value>
+		<value>TLSv1.2</value>
 	</property>
 	<property>
 		<name>ranger.usersync.passwordvalidator.path</name>

diff --git a/...authservice/src/main/java/org/apache/ranger/authentication/UnixAuthenticationService.java b/...authservice/src/main/java/org/apache/ranger/authentication/UnixAuthenticationService.java
@@ -58,7 +58,7 @@ public class UnixAuthenticationService {
 
 	private static final String serviceName = "UnixAuthenticationService";
 
-	private static final String SSL_ALGORITHM = "TLS";
+	private static final String SSL_ALGORITHM = "TLSv1.2";
 	private static final String REMOTE_LOGIN_AUTH_SERVICE_PORT_PARAM = "ranger.usersync.port";
 
 	private static final String SSL_KEYSTORE_PATH_PARAM = "ranger.usersync.keystore.file";
@@ -237,7 +237,7 @@ private void init() throws Throwable {
 		String SSLEnabledProp = prop.getProperty(SSL_ENABLED_PARAM);
 
 		SSLEnabled = (SSLEnabledProp != null &&  (SSLEnabledProp.equalsIgnoreCase("true")));
-		String defaultEnabledProtocols = "SSLv2Hello, TLSv1, TLSv1.1, TLSv1.2";
+		String defaultEnabledProtocols = "TLSv1.2";
 		String enabledProtocols = prop.getProperty("ranger.usersync.https.ssl.enabled.protocols", defaultEnabledProtocols);
 		enabledProtocolsList=new ArrayList<String>(Arrays.asList(enabledProtocols.toUpperCase().trim().split("\\s*,\\s*")));
 //		LOG.info("Key:" + keyStorePath);