Metalab Services: Unterschied zwischen den Versionen
Hop (Diskussion | Beiträge) fuck mediawiki in particular |
Pepi (Diskussion | Beiträge) →Things that need to be done: Moved comments to discussion page: https://metalab.at/wiki/Diskussion:Metalab_Services |
||
| Zeile 40: | Zeile 40: | ||
Anything missing? Please [https://metalab.at/wiki/index.php?title=Metalab_Services&action=edit§ion=1 add] it! | Anything missing? Please [https://metalab.at/wiki/index.php?title=Metalab_Services&action=edit§ion=1 add] it! | ||
=== Things that need to be done === | === Things that need to be done === | ||
This is a DRAFT list meant to aggregate things that likely should be looked at if they need any relevant updates. Known security issues should be regarded as relevant. | |||
* Document all changes, updates, etc. | * Document all changes, updates, etc. | ||
* Update Apache to 2.2.26 (current as of 2013-11-19) or switch to nginx | * Update Apache to 2.2.26 (current as of 2013-11-19) or switch to nginx | ||
* Update to eJabberd 13.10 (current as of 2013-11-19) or switch to prosody | * Update to eJabberd 13.10 (current as of 2013-11-19) or switch to prosody | ||
* Check ALL the Certificates for ALL the services. Acquire certificates for services that do not yet have one. (Basically do not host any unencrypted services anymore) | * Check ALL the Certificates for ALL the services. Acquire certificates for services that do not yet have one. (Basically do not host any unencrypted services anymore) | ||
* Provide forward secrecy for all services by using modern ciphers (EDH) | * Provide forward secrecy for all services by using modern ciphers (EDH) | ||
* Discuss the use of ECC as the only widely implemented curves are known and deliberately weakened curves specified by NIST. (secp256r1, secp385r1). [[User:Pepi|Pepi]] recommends not to use ECC if possible but provide (p)fs by using | * Discuss the use of ECC as the only widely implemented curves are known and deliberately weakened curves specified by NIST. (secp256r1, secp385r1). [[User:Pepi|Pepi]] recommends not to use ECC with NIST curves if possible but provide (p)fs by using DHE (works with all current browsers except for Internet Explorer which only supports forward secrecy using ECDHE on Vista an newer.) | ||
* Update Mediawiki to the current release | * Update Mediawiki to the current release | ||
* Update Trac to the current release | * Update Trac to the current release | ||
* Check validity of ALL certificates and set up reminders to renew them. Find at least two persons who are volunteering to take care of that as well! | * Check validity of ALL certificates and set up reminders to renew them. Find at least two persons who are volunteering to take care of that as well! | ||