Logging TLS cipher suite

Wed Apr 21 16:01:21 UTC 2021

Scott,

Does this log the TLS protocol version as well?  TLS 1.0 and 1.1 could be used with a "good" cipher, but we still want to disable TLS 1.0 and 1.1.  Knowing the cipher used may not be sufficient.

Thanks,
Andy

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Wednesday, April 21, 2021 6:28 AM
To: users at shibboleth.net <users at shibboleth.net>
Subject: Logging TLS cipher suite

[This email originated from outside of OSU. Use caution with links and attachments.]

Forgive the InCommon spam but this came up on a webinar about the upcoming change to require participants to turn off TLS 1.0 and 1.1.

Assuming you don't proxy (yet another reason proxying sucks), there are a lot of ways to do this, including adding a field to the idP audit log, but a simple and all-purpose way I found to log it is just in the servlet access log by changing the logback-access pattern to:

<pattern>
%h %l %u [%t] "%r" %s %b "%i{Referer}" "%i{User-Agent}" %reqAttribute{javax.servlet.request.cipher_suite}
</pattern>

That's "combined" plus the attribute with the cipher.

I added a blurb about it to the Jetty94 page. Tomcat supports logback use as well for access logging and the same configuration would probably work, dunno.

-- Scott

--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7C%7Ce9f3f0015c584fff941808d904c969cd%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C637546085389546063%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=MsSejbFOfP2b%2BARZ7qDbbQBVU9zZoy1yiDwhqHGJzog%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210421/db668382/attachment.htm>