3 ms·

Does anyone know why CloudFlare uses TLS internally? I'm assuming they mean over their intranet of web servers, so if those are behind a firewall with their ipt

Does anyone know why CloudFlare uses TLS internally? I'm assuming they mean over their intranet of web servers, so if those are behind a firewall with their iptables configured properly, then what's the point of using TLS?

46Bit 13y ago
If some of them are in different DCs or on non-dedicated hardware, probably to stop their comms being intercepted.
mattzito 13y ago
It's long been a best practice for highly secure environments to use transport encryption between all tiers. The idea is that if someone compromises your datacenter, it's often a second-tier box, a forgotten web app, an ssh bastion host, etc. These boxes might not have any sensitive information on them. However, the attacker might be able to use that box as a jumping off point to attack switches or other network devices where you could configure the network port of a compromised machine to receive a copy of all of the data being transmitted on the ports of more sensitive servers. You should treat external firewalls and iptables like seatbelts in cars - yes, they're great, yes, you're a lot more likely to survive something terrible with them, but that doesn't mean you can drive recklessly and drunk.
jgrahamc 13y ago
We have 23 locations around the world where we have servers. Those servers need to be administered, monitored, backed up, rebooted, and synchronized. So we make extensive use of SSH and TLS. Yes, there are all sorts of firewalls and iptables rules to create an 'intranet' across the world, but that doesn't stop the actual packets from passing the public Internet. There's really no reason not to use TLS.
- stock_toaster 13y ago
  Is what you noted in the post still what you use for the nginx ssl_ciphers string? When I ran that through `openssl ciphers -v` I got wildly different ordering from what is shown as cipher priority in the post.
  - jgrahamc 13y ago
    Ah. It looks like I've put the wrong configuration in the blog post. My fault. I shall update the blog post with the correct configuration. Here's what we are currently using: ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA; ssl_prefer_server_ciphers on;
    - stock_toaster 13y ago
      thanks!
    - reedloden 13y ago
      Why do you turn off the CAMELLIA ciphers?

46Bit 13y ago

If some of them are in different DCs or on non-dedicated hardware, probably to stop their comms being intercepted.

mattzito 13y ago

It's long been a best practice for highly secure environments to use transport encryption between all tiers. The idea is that if someone compromises your datacenter, it's often a second-tier box, a forgotten web app, an ssh bastion host, etc. These boxes might not have any sensitive information on them. However, the attacker might be able to use that box as a jumping off point to attack switches or other network devices where you could configure the network port of a compromised machine to receive a copy of all of the data being transmitted on the ports of more sensitive servers. You should treat external firewalls and iptables like seatbelts in cars - yes, they're great, yes, you're a lot more likely to survive something terrible with them, but that doesn't mean you can drive recklessly and drunk.

jgrahamc 13y ago

We have 23 locations around the world where we have servers. Those servers need to be administered, monitored, backed up, rebooted, and synchronized. So we make extensive use of SSH and TLS. Yes, there are all sorts of firewalls and iptables rules to create an 'intranet' across the world, but that doesn't stop the actual packets from passing the public Internet. There's really no reason not to use TLS.

stock_toaster 13y ago
Is what you noted in the post still what you use for the nginx ssl_ciphers string? When I ran that through `openssl ciphers -v` I got wildly different ordering from what is shown as cipher priority in the post.
- jgrahamc 13y ago
  Ah. It looks like I've put the wrong configuration in the blog post. My fault. I shall update the blog post with the correct configuration. Here's what we are currently using: ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA; ssl_prefer_server_ciphers on;
  - stock_toaster 13y ago
    thanks!
  - reedloden 13y ago
    Why do you turn off the CAMELLIA ciphers?