prosody-modules
750d64c47ec6
mod_tls_policy/README.md

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody-modules

Comparison

mod_tls_policy/README.md @ 6211:750d64c47ec6 draft default tip

Merge
author Trần H. Trung <xmpp:trần.h.trung@trung.fun>
date Tue, 18 Mar 2025 00:31:36 +0700
parent 6003:fe081789f7b5
comparison
equal deleted inserted replaced
6210:24316a399978 6211:750d64c47ec6
1 ---
2 summary: Cipher policy enforcement with application level error reporting
3 ...
4
5 # Introduction
6
7 This module arose from discussions at the XMPP Summit about enforcing
8 better ciphers in TLS. It may seem attractive to disallow some insecure
9 ciphers or require forward secrecy, but doing this at the TLS level
10 would the user with an unhelpful "Encryption failed" message. This
11 module does this enforcing at the application level, allowing better
12 error messages.
13
14 # Configuration
15
16 First, download and add the module to `module_enabled`. Then you can
17 decide on what policy you want to have.
18
19 Requiring ciphers with forward secrecy is the most simple to set up.
20
21 ``` lua
22 tls_policy = "FS" -- allow only ciphers that enable forward secrecy
23 ```
24
25 A more complicated example:
26
27 ``` lua
28 tls_policy = {
29 c2s = {
30 encryption = "AES"; -- Require AES (or AESGCM) encryption
31 protocol = "TLSv1.2"; -- and TLSv1.2
32 bits = 128; -- and at least 128 bits (FIXME: remember what this meant)
33 }
34 s2s = {
35 cipher = "AESGCM"; -- Require AESGCM ciphers
36 protocol = "TLSv1.[12]"; -- and TLSv1.1 or 1.2
37 authentication = "RSA"; -- with RSA authentication
38 };
39 }
40 ```
41
42 # Compatibility
43
44 Requires LuaSec 0.5
45