couchdb windows crypto

[riffraff169]

How do we find out what crypto library (windows or openssl) that couchdb was compile for?

[big-r81]

All used DLLs are in the CouchDB bin/ directory after installation.

[riffraff169]

We are trying to find which crypto library, windows or openssl, this is using because we are having a hard time restricting the ecc curves like rabbitmq. Is there a way to do that for couchdb on windows?

[big-r81]

Can you explain what you want to achive?

[riffraff169]

We have someone who is trying to remove the weak keys, like TLSv1.2 DHE-RSA-AES256-GCM-SHA384 DHE 1024 yes 80 low. A scan showed some weak key-exchange groups like sect163k1, sect163r1, and others. Apparently in rabbitmq, you can specify using the following:

{ciphers, [
"TLS_AES_256_GCM_SHA384",
...
]),
{eccs, [
secp224k1,
secp224r1,
...
]}
...

But couchdb doesn't seem to recognize that, at least not in windows.

How would they remove the weak keys?

[big-r81]

Maybe you can set some Erlang settings via a conf file. Some settings for the inter-node connection may be set via some ssl options.

But I don't see yet, how this can help you, because you create the certs by yourself and can set the correct curves/ciphers and if you use JWT tokens, it's the same. Maybe @nickva has some more tips ...

[dpavlov2024]

Hi, conf file describes this option > #-ssl_dist_optfile <path/to/couch_ssl_dist.conf>. But that is for ->## Use TLS for connections between Erlang cluster members.

It is needed to take the elliptic curves under control. Something like this in ssl.conf file + -ssl_dist_optfile "C:/Program Files/Apache CouchDB/etc/ssl.config" in vm.args.

{ssl,
[
{elliptic_curves, [
'prime256v1', % NIST P-256
'secp384r1' % NIST P-384
]}
]}

SSL settings in local.ini file
enable = true
cert_file = C:/Program Files/Apache CouchDB/etc/certs/couchdb.pem
key_file = C:/Program Files/Apache CouchDB/etc/certs/couchdb.key
; cacert_file = C:/CouchDB/etc/couchdb/cacert.pem ; if you have a CA certificate
;tls_versions = ['tlsv1.2', 'tlsv1.3']
tls_versions = ['tlsv1.2']
disable_compression = true
ciphers = ["ECDHE-ECDSA-AES256-GCM-SHA384", "ECDHE-RSA-AES256-GCM-SHA384", "ECDHE-ECDSA-CHACHA20-POLY1305", "ECDHE-RSA-CHACHA20-POLY1305", "ECDHE-ECDSA-AES128-GCM-SHA256", "ECDHE-RSA-AES128-GCM-SHA256"]

It does not work for me.

OUTPUT
sslscan localhost:6984 (https://github.com/rbsec/sslscan). Always the same output
Heartbleed:
TLSv1.2 not vulnerable to heartbleed

Supported Server Cipher(s):
Preferred TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve P-256 DHE 256
Accepted TLSv1.2 256 bits ECDHE-RSA-CHACHA20-POLY1305 Curve P-256 DHE 256
Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve P-256 DHE 256

Server Key Exchange Group(s):
TLSv1.2 81 bits sect163k1
TLSv1.2 81 bits sect163r1
TLSv1.2 81 bits sect163r2
TLSv1.2 96 bits sect193r1
TLSv1.2 96 bits sect193r2
TLSv1.2 116 bits sect233k1
TLSv1.2 116 bits sect233r1
TLSv1.2 119 bits sect239k1
TLSv1.2 141 bits sect283k1
TLSv1.2 141 bits sect283r1
TLSv1.2 204 bits sect409k1
TLSv1.2 204 bits sect409r1
TLSv1.2 285 bits sect571k1
TLSv1.2 285 bits sect571r1
TLSv1.2 80 bits secp160k1
TLSv1.2 80 bits secp160r1
TLSv1.2 80 bits secp160r2
TLSv1.2 96 bits secp192k1
TLSv1.2 96 bits secp192r1
TLSv1.2 112 bits secp224k1
TLSv1.2 112 bits secp224r1
TLSv1.2 128 bits secp256k1
TLSv1.2 128 bits secp256r1 (NIST P-256)
TLSv1.2 192 bits secp384r1 (NIST P-384)
TLSv1.2 260 bits secp521r1 (NIST P-521)
TLSv1.2 128 bits brainpoolP256r1
TLSv1.2 192 bits brainpoolP384r1
TLSv1.2 256 bits brainpoolP512r1

Everything below 2xx is considered to be weak.

Could you, please, share, exact steps what should be done?

I'm successful till here:

1. Provisioned Windows Server 2016 box;
2. Installed CouchDB 3.3.3
3. Geenrated self signed cert using openssl.
4. Used the cert in the CouchDB local.ini config.
5. Removed unneeded ciphers.
6. And then? How do I take the curves under control?

By the way tools like Apache, NGING, HAProxy allow to control it from their native config files? Are there plan to implement the same in CouchDB, via local.ini for example?

[big-r81]

With PR #5212 you can configure the clustered port.