Ceph » mgr » Dashboard

even though the default connection will always attempt to use the most secure method available, it will also respond to less secure/vulnerable protocols and cyphers, so there should be a way to completely disable TLS v1.2.

in the Dashboard module.py line 180, we have this lines

context.minimum_version = ssl.TLSVersion.TLSv1_2
context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1

it'd be a matter of increasing that to 1_3 and adding ssl.OP_NO_TLSv2

The minimum_version approach requires Python 3.7: https://docs.python.org/3/library/ssl.html#ssl.SSLContext.minimum_version
For Py <3.7, we have to use ssl.OP_NO_TLS* flags (https://docs.python.org/3/library/ssl.html#ssl.OP_NO_TLSv1)

Description of problem¶

here

Environment¶

• ceph version string:
• Platform (OS/distro/release):
• Cluster details (nodes, monitors, OSDs):
• Did it happen on a stable environment or after a migration/upgrade?:
• Browser used (e.g.: Version 86.0.4240.198 (Official Build) (64-bit)):

How reproducible¶

Steps:

3. ...

Actual results¶

Please add logs and/or screenshots

Expected results¶

here

Additional info¶

here