<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Scott,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Does this log the TLS protocol version as well? TLS 1.0 and 1.1 could be used with a "good" cipher, but we still want to disable TLS 1.0 and 1.1. Knowing the cipher used may not be sufficient.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andy<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Wednesday, April 21, 2021 6:28 AM<br>
<b>To:</b> users@shibboleth.net <users@shibboleth.net><br>
<b>Subject:</b> Logging TLS cipher suite</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">[This email originated from outside of OSU. Use caution with links and attachments.]<br>
<br>
Forgive the InCommon spam but this came up on a webinar about the upcoming change to require participants to turn off TLS 1.0 and 1.1.<br>
<br>
Assuming you don't proxy (yet another reason proxying sucks), there are a lot of ways to do this, including adding a field to the idP audit log, but a simple and all-purpose way I found to log it is just in the servlet access log by changing the logback-access
pattern to:<br>
<br>
<pattern><br>
%h %l %u [%t] "%r" %s %b "%i{Referer}" "%i{User-Agent}" %reqAttribute{javax.servlet.request.cipher_suite}<br>
</pattern><br>
<br>
That's "combined" plus the attribute with the cipher.<br>
<br>
I added a blurb about it to the Jetty94 page. Tomcat supports logback use as well for access logging and the same configuration would probably work, dunno.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7C%7Ce9f3f0015c584fff941808d904c969cd%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C637546085389546063%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=MsSejbFOfP2b%2BARZ7qDbbQBVU9zZoy1yiDwhqHGJzog%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7C%7Ce9f3f0015c584fff941808d904c969cd%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C637546085389546063%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=MsSejbFOfP2b%2BARZ7qDbbQBVU9zZoy1yiDwhqHGJzog%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</div>
</body>
</html>