Avoid usage of legacy algorithms on libssl-3.0+ #53
Conversation
Single DES and MD4 are considered legacy algorithms in OpenSSL/libssl-3.0. They can be enabled by adjusting the openssl configuration file or by using the new provider concept of OpenSSL-3. Editing the configuration must be done by each use of rubyntlm, which is very inconvenient. The provider API is not yet supported by the ruby binding to OpenSSL. So it's better to avoid the legacy algorithms at all. The single DES algorithm can easily implemented by a two key 3-DES run. The md4 implementation is taken from here: https://gist.github.com/tprynn/5419da1a2ad8935c1fff And the rc4 implementation is taken from here and modified: https://github.com/caiges/Ruby-RC4/blob/082fce56ab707dc77442709357cf176f7b3b6f22/lib/rc4.rb Fixes WinRb#49
... which is the default on ubuntu-22.04. OpenSSL-3.0 has some limitations regarding outdated algorithms.
|
A CI run on Ubuntu-22.04 without this patch fails like so: https://github.com/larskanis/rubyntlm/runs/7068752401?check_suite_focus=true |
|
@mwrock Gentle ping... Any chance to get this into a new release? |
|
Background is that I maintain https://github.com/larskanis/pg-ldap-sync/ which can use NTLM authentication through the |
|
Thanks for this patch. Do you know if there is a way to force the client to always use NTLM v2 (which I think would at least stop using the MD4 algorithm?) I looked a bit but I dont see anything obvious. |
|
@donoghuc Sorry no, I don't know much about the NTLM internals. |
|
Thanks I will let you know what solution we (over at puppet puppetlabs/bolt#3191 ) come up with. Cheers. |
|
We also have exactly the same issue. It would be very nice if we can find a solution here soon. |
|
+1 |
|
thank you! |
Single DES and MD4 are considered legacy algorithms in OpenSSL/libssl-3.0. They can be enabled by adjusting the openssl configuration file or by using the new provider concept of OpenSSL-3. Editing the configuration must be done by each user of rubyntlm, which is very inconvenient. The provider API is not yet supported by the ruby binding to OpenSSL.
So it's better to avoid the legacy algorithms at all.
The single DES algorithm can easily implemented by a two key 3-DES run.
The md4 implementation is taken from here:
https://gist.github.com/tprynn/5419da1a2ad8935c1fff
And the rc4 implementation is taken from here and modified:
https://github.com/caiges/Ruby-RC4/blob/082fce56ab707dc77442709357cf176f7b3b6f22/lib/rc4.rb
Fixes #49